Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-1471
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Red Hat. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 10 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 9 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.2 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Power, little endian 9 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.8 x86_64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.8 s390x | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for ARM 64 10 aarch64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.0 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Power, little endian 10 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.2 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.8 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for IBM z Systems 10 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux Server - AUS 9.6 x86_64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.2 aarch64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.2 aarch64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux Server - AUS 8.6 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.6 aarch64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Real Time for x86_64 - Extended Life Cycle Support 7 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.2 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Power, little endian 8 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.2 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems 8 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux Server - TUS 8.8 x86_64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6 x86_64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.0 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux Server - AUS 9.4 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for ARM 64 8 aarch64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for x86_64 8 x86_64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.0 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 9 aarch64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for x86_64 10 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for Power, little endian 10 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux Server - AUS 8.4 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Real Time for NFV 8 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.2 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.6 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux Server - AUS 9.2 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 8 aarch64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.6 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.8 aarch64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.6 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems 9 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 8 x86_64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for x86_64 9 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Real Time 8 x86_64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 10 aarch64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems 10 s390x | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.0 aarch64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for ARM 64 9 aarch64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux Hidden Content for x86_64 10 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x | ||
| Red Hat | N/A | Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 | ||
| Red Hat | N/A | Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64 | ||
| Red Hat | N/A | Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.8 x86_64 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Red Hat Enterprise Linux for x86_64 10 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 9 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.2 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian 9 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.8 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.8 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for ARM 64 10 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.0 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian 10 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.2 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.8 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for IBM z Systems 10 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server - AUS 9.6 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.2 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.2 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server - AUS 8.6 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.6 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Real Time for x86_64 - Extended Life Cycle Support 7 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.2 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian 8 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.2 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems 8 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server - TUS 8.8 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.0 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server - AUS 9.4 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for ARM 64 8 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for x86_64 8 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.0 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 9 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for x86_64 10 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for Power, little endian 10 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server - AUS 8.4 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Real Time for NFV 8 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.2 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.6 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server - AUS 9.2 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 8 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.6 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.8 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.6 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems 9 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 8 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for x86_64 9 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Real Time 8 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 10 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems 10 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.0 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for ARM 64 9 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Hidden Content for x86_64 10 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.8 x86_64",
"product": {
"name": "N/A",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-74283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74283"
},
{
"name": "CVE-2026-63974",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63974"
},
{
"name": "CVE-2026-74669",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74669"
},
{
"name": "CVE-2026-52929",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52929"
},
{
"name": "CVE-2026-63993",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63993"
},
{
"name": "CVE-2026-64319",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64319"
},
{
"name": "CVE-2026-63924",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63924"
},
{
"name": "CVE-2026-72083",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72083"
},
{
"name": "CVE-2026-68155",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68155"
},
{
"name": "CVE-2026-53224",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53224"
},
{
"name": "CVE-2026-74586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74586"
},
{
"name": "CVE-2026-64017",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64017"
},
{
"name": "CVE-2026-98974",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98974"
},
{
"name": "CVE-2026-80864",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80864"
},
{
"name": "CVE-2026-80714",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80714"
},
{
"name": "CVE-2026-68476",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68476"
},
{
"name": "CVE-2026-43450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43450"
},
{
"name": "CVE-2026-68169",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68169"
},
{
"name": "CVE-2026-64534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64534"
},
{
"name": "CVE-2026-72080",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72080"
},
{
"name": "CVE-2026-72222",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72222"
},
{
"name": "CVE-2026-99999",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99999"
},
{
"name": "CVE-2026-43493",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43493"
},
{
"name": "CVE-2026-46259",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46259"
},
{
"name": "CVE-2026-89846",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89846"
},
{
"name": "CVE-2026-46174",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46174"
},
{
"name": "CVE-2026-98222",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98222"
},
{
"name": "CVE-2026-98432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98432"
},
{
"name": "CVE-2026-80792",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80792"
},
{
"name": "CVE-2026-98403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98403"
},
{
"name": "CVE-2026-63875",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63875"
},
{
"name": "CVE-2026-63996",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63996"
},
{
"name": "CVE-2026-63984",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63984"
},
{
"name": "CVE-2026-43051",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43051"
},
{
"name": "CVE-2026-63987",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63987"
},
{
"name": "CVE-2026-74641",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74641"
},
{
"name": "CVE-2026-68159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68159"
},
{
"name": "CVE-2026-64541",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64541"
},
{
"name": "CVE-2026-80586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80586"
},
{
"name": "CVE-2026-63920",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63920"
},
{
"name": "CVE-2026-64191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64191"
},
{
"name": "CVE-2026-64378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64378"
},
{
"name": "CVE-2026-80584",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80584"
},
{
"name": "CVE-2026-98466",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98466"
},
{
"name": "CVE-2025-68745",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68745"
},
{
"name": "CVE-2026-89488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89488"
},
{
"name": "CVE-2026-80863",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80863"
},
{
"name": "CVE-2026-53228",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53228"
},
{
"name": "CVE-2026-53073",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53073"
},
{
"name": "CVE-2026-98725",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98725"
},
{
"name": "CVE-2026-93827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93827"
},
{
"name": "CVE-2026-74582",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74582"
},
{
"name": "CVE-2026-90227",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90227"
},
{
"name": "CVE-2026-68398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68398"
},
{
"name": "CVE-2026-74752",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74752"
},
{
"name": "CVE-2025-71066",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-71066"
},
{
"name": "CVE-2026-68156",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68156"
},
{
"name": "CVE-2026-43020",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43020"
},
{
"name": "CVE-2026-68451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68451"
},
{
"name": "CVE-2026-80553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80553"
},
{
"name": "CVE-2026-98364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98364"
},
{
"name": "CVE-2026-74510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74510"
},
{
"name": "CVE-2026-46056",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46056"
},
{
"name": "CVE-2026-89479",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89479"
},
{
"name": "CVE-2026-74588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74588"
},
{
"name": "CVE-2026-89481",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89481"
},
{
"name": "CVE-2025-39797",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39797"
},
{
"name": "CVE-2026-46086",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46086"
},
{
"name": "CVE-2026-74556",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74556"
},
{
"name": "CVE-2026-46149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46149"
},
{
"name": "CVE-2026-93787",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93787"
},
{
"name": "CVE-2026-64303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64303"
},
{
"name": "CVE-2026-89932",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89932"
},
{
"name": "CVE-2026-63831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63831"
},
{
"name": "CVE-2026-68452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68452"
},
{
"name": "CVE-2025-21702",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21702"
},
{
"name": "CVE-2022-50315",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-50315"
},
{
"name": "CVE-2026-72098",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72098"
},
{
"name": "CVE-2026-72221",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72221"
},
{
"name": "CVE-2026-22977",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22977"
},
{
"name": "CVE-2026-53270",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53270"
},
{
"name": "CVE-2026-63922",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63922"
},
{
"name": "CVE-2026-90011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90011"
},
{
"name": "CVE-2026-53246",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53246"
},
{
"name": "CVE-2026-80571",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80571"
},
{
"name": "CVE-2026-72243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72243"
},
{
"name": "CVE-2026-68162",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68162"
},
{
"name": "CVE-2026-90315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90315"
},
{
"name": "CVE-2026-64007",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64007"
},
{
"name": "CVE-2026-53062",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53062"
},
{
"name": "CVE-2026-89603",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89603"
},
{
"name": "CVE-2026-52972",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52972"
},
{
"name": "CVE-2026-63802",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63802"
}
],
"initial_release_date": "2026-11-06T00:00:00",
"last_revision_date": "2026-11-06T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1471",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-11-06T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Red Hat. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Red Hat",
"vendor_advisories": [
{
"published_at": "2026-11-01",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:93412",
"url": "https://access.redhat.com/errata/RHSA-2026:93412"
},
{
"published_at": "2026-11-05",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:95556",
"url": "https://access.redhat.com/errata/RHSA-2026:95556"
},
{
"published_at": "2026-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:94508",
"url": "https://access.redhat.com/errata/RHSA-2026:94508"
},
{
"published_at": "2026-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:94303",
"url": "https://access.redhat.com/errata/RHSA-2026:94303"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:95100",
"url": "https://access.redhat.com/errata/RHSA-2026:95100"
},
{
"published_at": "2026-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:94438",
"url": "https://access.redhat.com/errata/RHSA-2026:94438"
},
{
"published_at": "2026-11-05",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:95370",
"url": "https://access.redhat.com/errata/RHSA-2026:95370"
},
{
"published_at": "2026-11-02",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:93775",
"url": "https://access.redhat.com/errata/RHSA-2026:93775"
},
{
"published_at": "2026-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:94623",
"url": "https://access.redhat.com/errata/RHSA-2026:94623"
},
{
"published_at": "2026-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:94558",
"url": "https://access.redhat.com/errata/RHSA-2026:94558"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:94996",
"url": "https://access.redhat.com/errata/RHSA-2026:94996"
},
{
"published_at": "2026-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:94596",
"url": "https://access.redhat.com/errata/RHSA-2026:94596"
},
{
"published_at": "2026-11-01",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:93413",
"url": "https://access.redhat.com/errata/RHSA-2026:93413"
},
{
"published_at": "2026-11-05",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:95721",
"url": "https://access.redhat.com/errata/RHSA-2026:95721"
},
{
"published_at": "2026-11-02",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:93930",
"url": "https://access.redhat.com/errata/RHSA-2026:93930"
},
{
"published_at": "2026-10-30",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:93047",
"url": "https://access.redhat.com/errata/RHSA-2026:93047"
},
{
"published_at": "2026-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:94477",
"url": "https://access.redhat.com/errata/RHSA-2026:94477"
},
{
"published_at": "2026-11-02",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:93911",
"url": "https://access.redhat.com/errata/RHSA-2026:93911"
},
{
"published_at": "2026-11-02",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:94109",
"url": "https://access.redhat.com/errata/RHSA-2026:94109"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:95212",
"url": "https://access.redhat.com/errata/RHSA-2026:95212"
},
{
"published_at": "2026-11-01",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:93415",
"url": "https://access.redhat.com/errata/RHSA-2026:93415"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:95367",
"url": "https://access.redhat.com/errata/RHSA-2026:95367"
},
{
"published_at": "2026-11-02",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:93670",
"url": "https://access.redhat.com/errata/RHSA-2026:93670"
}
]
}
CVE-2026-80792 (GCVE-0-2026-80792)
Vulnerability from cvelistv5
Published
2026-09-04 15:13
Modified
2026-11-06 17:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix use-after-free in ip6_finish_output2()
ip6_finish_output2() caches a pointer to the IPv6 destination
address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF
transmit path or other encapsulation operations within
lwtunnel_xmit() can reallocate the skb head, freeing the memory
that daddr points to. When lwtunnel_xmit() returns
LWTUNNEL_XMIT_CONTINUE, the function continues to use the stale
daddr pointer to compute the nexthop and to look up or create the
neighbour entry. This results in a use-after-free read, which can
leak sensitive kernel data, pollute the neighbour table with
arbitrary values, misdirect traffic, or crash the system.
Fix this by re-fetching the IPv6 header and the destination
address pointer after lwtunnel_xmit() returns
LWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop
computation and neighbour lookup operate on valid memory.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4132c4ad00ddbf3a175ea0d2c775b662a32f4c85 Version: e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 Version: e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 Version: e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 Version: e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 Version: e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 Version: e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 Version: e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 Version: e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 Version: 1598154fd28ffa4a55beae1970475fd6776554b6 Version: 5.10.233 ≤ Version: 5.4.289 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80792",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T17:03:27.127514Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T17:05:54.401Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "75e0a544ebe9af663ef53ca21e9e9185c51fb54a",
"status": "affected",
"version": "4132c4ad00ddbf3a175ea0d2c775b662a32f4c85",
"versionType": "git"
},
{
"lessThan": "c95f01b78266828a57060d754fcbfc92123a98ed",
"status": "affected",
"version": "e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2",
"versionType": "git"
},
{
"lessThan": "d960881b9312e781a3429aabceb223ce6b7c882f",
"status": "affected",
"version": "e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2",
"versionType": "git"
},
{
"lessThan": "087ee0d914aaae929f1660c9ca878e367655ba1a",
"status": "affected",
"version": "e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2",
"versionType": "git"
},
{
"lessThan": "3c770ac4e6f07af7c7b40c474a3efc61ffed7862",
"status": "affected",
"version": "e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2",
"versionType": "git"
},
{
"lessThan": "3dc98e5fe82d069dd29b124ffbdb679331dfea43",
"status": "affected",
"version": "e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2",
"versionType": "git"
},
{
"lessThan": "99219c82804f266189388e8bf1cf5135d10d5515",
"status": "affected",
"version": "e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2",
"versionType": "git"
},
{
"lessThan": "73a187384a8c8b983c7fea046d716b6752a1e7a3",
"status": "affected",
"version": "e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2",
"versionType": "git"
},
{
"lessThan": "d0d48d999b0eee6bb176ef4e39d9be868fa80f7e",
"status": "affected",
"version": "e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2",
"versionType": "git"
},
{
"status": "affected",
"version": "1598154fd28ffa4a55beae1970475fd6776554b6",
"versionType": "git"
},
{
"lessThan": "5.10.267",
"status": "affected",
"version": "5.10.233",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.289",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "5.10.233",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.47",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.11",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.1",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.289",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix use-after-free in ip6_finish_output2()\n\nip6_finish_output2() caches a pointer to the IPv6 destination\naddress (daddr) before invoking lwtunnel_xmit(). The LWT-BPF\ntransmit path or other encapsulation operations within\nlwtunnel_xmit() can reallocate the skb head, freeing the memory\nthat daddr points to. When lwtunnel_xmit() returns\nLWTUNNEL_XMIT_CONTINUE, the function continues to use the stale\ndaddr pointer to compute the nexthop and to look up or create the\nneighbour entry. This results in a use-after-free read, which can\nleak sensitive kernel data, pollute the neighbour table with\narbitrary values, misdirect traffic, or crash the system.\n\nFix this by re-fetching the IPv6 header and the destination\naddress pointer after lwtunnel_xmit() returns\nLWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop\ncomputation and neighbour lookup operate on valid memory."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:43:45.535Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/75e0a544ebe9af663ef53ca21e9e9185c51fb54a"
},
{
"url": "https://git.kernel.org/stable/c/c95f01b78266828a57060d754fcbfc92123a98ed"
},
{
"url": "https://git.kernel.org/stable/c/d960881b9312e781a3429aabceb223ce6b7c882f"
},
{
"url": "https://git.kernel.org/stable/c/087ee0d914aaae929f1660c9ca878e367655ba1a"
},
{
"url": "https://git.kernel.org/stable/c/3c770ac4e6f07af7c7b40c474a3efc61ffed7862"
},
{
"url": "https://git.kernel.org/stable/c/3dc98e5fe82d069dd29b124ffbdb679331dfea43"
},
{
"url": "https://git.kernel.org/stable/c/99219c82804f266189388e8bf1cf5135d10d5515"
},
{
"url": "https://git.kernel.org/stable/c/73a187384a8c8b983c7fea046d716b6752a1e7a3"
},
{
"url": "https://git.kernel.org/stable/c/d0d48d999b0eee6bb176ef4e39d9be868fa80f7e"
}
],
"title": "ipv6: fix use-after-free in ip6_finish_output2()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80792",
"datePublished": "2026-09-04T15:13:04.537Z",
"dateReserved": "2026-08-26T14:34:25.793Z",
"dateUpdated": "2026-11-06T17:05:54.401Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68745 (GCVE-0-2025-68745)
Vulnerability from cvelistv5
Published
2025-12-24 12:09
Modified
2026-10-30 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Clear cmds after chip reset
Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling
and host reset handling") caused two problems:
1. Commands sent to FW, after chip reset got stuck and never freed as FW
is not going to respond to them anymore.
2. BUG_ON(cmd->sg_mapped) in qlt_free_cmd(). Commit 26f9ce53817a
("scsi: qla2xxx: Fix missed DMA unmap for aborted commands")
attempted to fix this, but introduced another bug under different
circumstances when two different CPUs were racing to call
qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in
dma_unmap_sg_attrs().
So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and
partially revert "scsi: qla2xxx: target: Fix offline port handling and
host reset handling" at __qla2x00_abort_all_cmds.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: aefed3e5548f28e5fecafda6604fcbc65484dbaa Version: aefed3e5548f28e5fecafda6604fcbc65484dbaa Version: aefed3e5548f28e5fecafda6604fcbc65484dbaa Version: aefed3e5548f28e5fecafda6604fcbc65484dbaa Version: aefed3e5548f28e5fecafda6604fcbc65484dbaa Version: eb67b7a23d357f578578e737cb6412ae2384f352 Version: ec9639d92c1e10d4bc667e842753d85e21683d5c Version: e6e957f552d5b696879a31e5b0e2a9120e1ea86e Version: 4.9.316 ≤ Version: 4.14.281 ≤ Version: 4.19.245 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68745",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:04:59.378599Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:09:43.983Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_os.c",
"drivers/scsi/qla2xxx/qla_target.c",
"drivers/scsi/qla2xxx/qla_target.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e87e9f92d7735895b7dd97f53dce6d95d08cf29c",
"status": "affected",
"version": "aefed3e5548f28e5fecafda6604fcbc65484dbaa",
"versionType": "git"
},
{
"lessThan": "0d0a1a267c1ee7c41aeffdca84afcb113787a91a",
"status": "affected",
"version": "aefed3e5548f28e5fecafda6604fcbc65484dbaa",
"versionType": "git"
},
{
"lessThan": "c82c0fbb97d0fd44324eb55ab758408c7c964b32",
"status": "affected",
"version": "aefed3e5548f28e5fecafda6604fcbc65484dbaa",
"versionType": "git"
},
{
"lessThan": "5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936",
"status": "affected",
"version": "aefed3e5548f28e5fecafda6604fcbc65484dbaa",
"versionType": "git"
},
{
"lessThan": "d46c69a087aa3d1513f7a78f871b80251ea0c1ae",
"status": "affected",
"version": "aefed3e5548f28e5fecafda6604fcbc65484dbaa",
"versionType": "git"
},
{
"status": "affected",
"version": "eb67b7a23d357f578578e737cb6412ae2384f352",
"versionType": "git"
},
{
"status": "affected",
"version": "ec9639d92c1e10d4bc667e842753d85e21683d5c",
"versionType": "git"
},
{
"status": "affected",
"version": "e6e957f552d5b696879a31e5b0e2a9120e1ea86e",
"versionType": "git"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.316",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.281",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.245",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_os.c",
"drivers/scsi/qla2xxx/qla_target.c",
"drivers/scsi/qla2xxx/qla_target.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.2",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.316",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.281",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.245",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Clear cmds after chip reset\n\nCommit aefed3e5548f (\"scsi: qla2xxx: target: Fix offline port handling\nand host reset handling\") caused two problems:\n\n1. Commands sent to FW, after chip reset got stuck and never freed as FW\n is not going to respond to them anymore.\n\n2. BUG_ON(cmd-\u003esg_mapped) in qlt_free_cmd(). Commit 26f9ce53817a\n (\"scsi: qla2xxx: Fix missed DMA unmap for aborted commands\")\n attempted to fix this, but introduced another bug under different\n circumstances when two different CPUs were racing to call\n qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in\n dma_unmap_sg_attrs().\n\nSo revert \"scsi: qla2xxx: Fix missed DMA unmap for aborted commands\" and\npartially revert \"scsi: qla2xxx: target: Fix offline port handling and\nhost reset handling\" at __qla2x00_abort_all_cmds."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote Fibre Channel/FCoE initiator can reach the vulnerable command lifecycle by sending FCP I/O and ABTS/TMR frames, without local host access.\nAC:L - The initiator can keep large PI/DIF I/O active while repeatedly issuing abort or reset requests, controlling both sides of the abort-versus-completion race.\nPR:N - Dynamic/demo ACL configurations admit fabric initiators without credentials, and WWPN-based session establishment requires no privilege on the target host.\nUI:N - Exploitation requires only attacker-generated fabric traffic and no victim action during the attack.\nS:U - The vulnerable driver and the affected kernel memory and storage resources belong to the same security authority.\nC:H - Concurrent unmapping can double-free shared DIF CRC-context and DSD objects, producing overlapping firmware-visible DMA contexts that can expose kernel or cross-command data.\nI:H - The DMA-pool double-free and concurrent DSD list deletion can corrupt kernel memory or redirect device DMA, potentially enabling arbitrary modification or code execution.\nA:H - The reported paths reach kernel BUG assertions, while reset-time command leaks can permanently exhaust resources; either can crash or render the target unavailable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:23:17.973Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e87e9f92d7735895b7dd97f53dce6d95d08cf29c"
},
{
"url": "https://git.kernel.org/stable/c/0d0a1a267c1ee7c41aeffdca84afcb113787a91a"
},
{
"url": "https://git.kernel.org/stable/c/c82c0fbb97d0fd44324eb55ab758408c7c964b32"
},
{
"url": "https://git.kernel.org/stable/c/5c1fb3fd05da3d55b8cbc42d7d660b313cbdc936"
},
{
"url": "https://git.kernel.org/stable/c/d46c69a087aa3d1513f7a78f871b80251ea0c1ae"
}
],
"title": "scsi: qla2xxx: Clear cmds after chip reset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68745",
"datePublished": "2025-12-24T12:09:41.517Z",
"dateReserved": "2025-12-24T10:30:51.031Z",
"dateUpdated": "2026-10-30T12:23:17.973Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90227 (GCVE-0-2026-90227)
Vulnerability from cvelistv5
Published
2026-09-17 16:07
Modified
2026-10-19 09:00
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls
nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a
partition device or write through a read-only file descriptor.
Pass flags and open_for_write through and reject disallowed commands
with -EACCES.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c35cd98eed1a863e8dd51073953563cd8c907f68",
"status": "affected",
"version": "a53295b6998f62d961c29e54051c1cf1d738c2b3",
"versionType": "git"
},
{
"lessThan": "95b0591d51dbf9e618d7845883d535e88ad7c8af",
"status": "affected",
"version": "a53295b6998f62d961c29e54051c1cf1d738c2b3",
"versionType": "git"
},
{
"lessThan": "736b7c6adc7a65c4411beff197b6a634f7a6ca27",
"status": "affected",
"version": "a53295b6998f62d961c29e54051c1cf1d738c2b3",
"versionType": "git"
},
{
"lessThan": "b116e9dae433ff631f94c36c61a7a78fe400ed1e",
"status": "affected",
"version": "a53295b6998f62d961c29e54051c1cf1d738c2b3",
"versionType": "git"
},
{
"lessThan": "b53d495c7f0db46b6748b5ade48371a10dd5d3bc",
"status": "affected",
"version": "a53295b6998f62d961c29e54051c1cf1d738c2b3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()\n\nUnlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls\nnvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a\npartition device or write through a read-only file descriptor.\n\nPass flags and open_for_write through and reject disallowed commands\nwith -EACCES."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Attacker-controlled opcode/slba/nblocks enter via copy_from_user of struct nvme_user_io in nvme_submit_io(), reached only through ioctl(NVME_IOCTL_SUBMIT_IO) on an NVMe block or ng* char node (blkdev_ioctl \u2192 nvme_ioctl / nvme_ns_chr_ioctl \u2192 nvme_ns_ioctl). No remote protocol carries that payload.\nAC:L - nvme_submit_io() copies the user nvme_user_io, accepts nvme_cmd_read/write/compare, and submits with the caller-chosen io.slba; there is no race or layout dependency, so the same ioctl reliably performs the I/O.\nPR:L - nvme_open()/nvme_ns_chr_open() impose no capability check, and the vulnerable nvme_submit_io() path never called nvme_cmd_allowed(), the only CAP_SYS_ADMIN gate for partition and read-only-fd I/O. An unprivileged user who can open a partition or O_RDONLY NVMe node can issue the ioctl.\nUI:N - The attacker opens the NVMe node they already control and issues NVME_IOCTL_SUBMIT_IO themselves; no other user must mount media, pass a file, or otherwise act.\nS:U - Skipping nvme_cmd_allowed() lets the caller read and write other LBAs of the same NVMe namespace in the host kernel. That is intra-OS partition/fd-mode bypass, not a VM, IOMMU, or guest-to-host boundary crossing.\nC:H - On a partition bdev, nvme_ioctl() still uses bdev-\u003ebd_disk-\u003eprivate_data (the whole namespace) and nvme_submit_io() programs c.rw.slba from attacker io.slba without adding bd_start_sect, so nvme_cmd_read returns arbitrary namespace LBAs including other partitions.\nI:H - The same path accepts io.opcode=nvme_cmd_write and, because nvme_cmd_allowed() is not called, ignores NVME_IOCTL_PARTITION and !open_for_write, so the attacker can persist writes to any namespace LBA from a partition fd or an O_RDONLY descriptor.\nA:H - Those unscoped nvme_cmd_write commands can overwrite other partitions\u0027 metadata, swap, or the OS image on the same namespace, persistently denying use of the host or co-tenant volumes (the failure mode nvme_cmd_allowed() exists to prevent)."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:00:03.749Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c35cd98eed1a863e8dd51073953563cd8c907f68"
},
{
"url": "https://git.kernel.org/stable/c/95b0591d51dbf9e618d7845883d535e88ad7c8af"
},
{
"url": "https://git.kernel.org/stable/c/736b7c6adc7a65c4411beff197b6a634f7a6ca27"
},
{
"url": "https://git.kernel.org/stable/c/b116e9dae433ff631f94c36c61a7a78fe400ed1e"
},
{
"url": "https://git.kernel.org/stable/c/b53d495c7f0db46b6748b5ade48371a10dd5d3bc"
}
],
"title": "nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90227",
"datePublished": "2026-09-17T16:07:35.989Z",
"dateReserved": "2026-09-11T19:38:34.794Z",
"dateUpdated": "2026-10-19T09:00:03.749Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43020 (GCVE-0-2026-43020)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-11-06 15:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: validate LTK enc_size on load
Load Long Term Keys stores the user-provided enc_size and later uses
it to size fixed-size stack operations when replying to LE LTK
requests. An enc_size larger than the 16-byte key buffer can therefore
overflow the reply stack buffer.
Reject oversized enc_size values while validating the management LTK
record so invalid keys never reach the stored key state.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 346af67b8d116f01ef696fd47959a55deb2db8b6 Version: 346af67b8d116f01ef696fd47959a55deb2db8b6 Version: 346af67b8d116f01ef696fd47959a55deb2db8b6 Version: 346af67b8d116f01ef696fd47959a55deb2db8b6 Version: 346af67b8d116f01ef696fd47959a55deb2db8b6 Version: 346af67b8d116f01ef696fd47959a55deb2db8b6 Version: 346af67b8d116f01ef696fd47959a55deb2db8b6 Version: 346af67b8d116f01ef696fd47959a55deb2db8b6 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43020",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:26:02.982602Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:32:26.427Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f37d1e65c6d71ad94ccfb5c602163c525db789d",
"status": "affected",
"version": "346af67b8d116f01ef696fd47959a55deb2db8b6",
"versionType": "git"
},
{
"lessThan": "257cdb960d8ff6d60bb6461b03c814b6cf0c9e64",
"status": "affected",
"version": "346af67b8d116f01ef696fd47959a55deb2db8b6",
"versionType": "git"
},
{
"lessThan": "c34577f517b556fb6ca173d45bf7e766ae2564ce",
"status": "affected",
"version": "346af67b8d116f01ef696fd47959a55deb2db8b6",
"versionType": "git"
},
{
"lessThan": "f71695e81f4cb428f3c7e2138eae88199005b52c",
"status": "affected",
"version": "346af67b8d116f01ef696fd47959a55deb2db8b6",
"versionType": "git"
},
{
"lessThan": "82f342b3b006ca1d65f4890c05f2ec32fcb808b6",
"status": "affected",
"version": "346af67b8d116f01ef696fd47959a55deb2db8b6",
"versionType": "git"
},
{
"lessThan": "50fb64defa72a3fecd0af1ca7c6b47b5c5c2b257",
"status": "affected",
"version": "346af67b8d116f01ef696fd47959a55deb2db8b6",
"versionType": "git"
},
{
"lessThan": "40ba329e8b4cd2fb11b0caf5e6a543ceaebb6009",
"status": "affected",
"version": "346af67b8d116f01ef696fd47959a55deb2db8b6",
"versionType": "git"
},
{
"lessThan": "b8dbe9648d69059cfe3a28917bfbf7e61efd7f15",
"status": "affected",
"version": "346af67b8d116f01ef696fd47959a55deb2db8b6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.4"
},
{
"lessThan": "3.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: validate LTK enc_size on load\n\nLoad Long Term Keys stores the user-provided enc_size and later uses\nit to size fixed-size stack operations when replying to LE LTK\nrequests. An enc_size larger than the 16-byte key buffer can therefore\noverflow the reply stack buffer.\n\nReject oversized enc_size values while validating the management LTK\nrecord so invalid keys never reach the stored key state."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:16:09.294Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f37d1e65c6d71ad94ccfb5c602163c525db789d"
},
{
"url": "https://git.kernel.org/stable/c/257cdb960d8ff6d60bb6461b03c814b6cf0c9e64"
},
{
"url": "https://git.kernel.org/stable/c/c34577f517b556fb6ca173d45bf7e766ae2564ce"
},
{
"url": "https://git.kernel.org/stable/c/f71695e81f4cb428f3c7e2138eae88199005b52c"
},
{
"url": "https://git.kernel.org/stable/c/82f342b3b006ca1d65f4890c05f2ec32fcb808b6"
},
{
"url": "https://git.kernel.org/stable/c/50fb64defa72a3fecd0af1ca7c6b47b5c5c2b257"
},
{
"url": "https://git.kernel.org/stable/c/40ba329e8b4cd2fb11b0caf5e6a543ceaebb6009"
},
{
"url": "https://git.kernel.org/stable/c/b8dbe9648d69059cfe3a28917bfbf7e61efd7f15"
}
],
"title": "Bluetooth: MGMT: validate LTK enc_size on load",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43020",
"datePublished": "2026-05-01T14:15:23.699Z",
"dateReserved": "2026-05-01T14:12:55.975Z",
"dateUpdated": "2026-11-06T15:32:26.427Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53062 (GCVE-0-2026-53062)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-10-19 19:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm cache policy smq: fix missing locks in invalidating cache blocks
In passthrough mode, the policy invalidate_mapping operation is called
simultaneously from multiple workers, thus it should be protected by a
lock. Otherwise, we might end up with data races on the allocated blocks
counter, or even use-after-free issues with internal data structures
when doing concurrent writes.
Note that the existing FIXME in smq_invalidate_mapping() doesn't affect
passthrough mode since migration tasks don't exist there, but would need
attention if supporting fast device shrinking via suspend/resume without
target reloading.
Reproduce steps:
1. Create a cache device consisting of 1024 cache entries
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0"
dmsetup create cdata --table "0 131072 linear /dev/sdc 8192"
dmsetup create corig --table "0 262144 linear /dev/sdc 262144"
dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct
dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \
/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
2. Populate the cache, and record the number of cached blocks
fio --name=populate --filename=/dev/mapper/cache --rw=randwrite --bs=4k \
--size=64m --direct=1
nr_cached=$(dmsetup status cache | awk '{split($7, a, "/"); print a[1]}')
3. Reload the cache into passthrough mode
dmsetup suspend cache
dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \
/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0"
dmsetup resume cache
4. Write to the passthrough cache. By setting multiple jobs with I/O
size equal to the cache block size, cache blocks are invalidated
concurrently from different workers.
fio --filename=/dev/mapper/cache --name=test --rw=randwrite --bs=64k \
--direct=1 --numjobs=2 --randrepeat=0 --size=64m
5. Check if demoted matches cached block count. These numbers should
match but may differ due to the data race.
nr_demoted=$(dmsetup status cache | awk '{print $12}')
echo "$nr_cached, $nr_demoted"
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53062",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:24:58.631300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:47:14.719Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-policy-smq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4991b5a08751e2e82488fb93ae08849b6aea10d9",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "1b2bec4a7dcf5f00b7a1cbeeec8997841d783513",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "ac5ee99443891bdb161f5539606a66a1b5e72542",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "93627a29d4b66d4a2def938dfb8610cc80ae454b",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "c348ae47d8e65f06429fa41adce9ad986b696766",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "2b62d0611c9af14a16bddf22df2612b4f40eb5a1",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "2d1f7b65f5deedd2e6b09fdc6ea27f8375f24b45",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-policy-smq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache policy smq: fix missing locks in invalidating cache blocks\n\nIn passthrough mode, the policy invalidate_mapping operation is called\nsimultaneously from multiple workers, thus it should be protected by a\nlock. Otherwise, we might end up with data races on the allocated blocks\ncounter, or even use-after-free issues with internal data structures\nwhen doing concurrent writes.\n\nNote that the existing FIXME in smq_invalidate_mapping() doesn\u0027t affect\npassthrough mode since migration tasks don\u0027t exist there, but would need\nattention if supporting fast device shrinking via suspend/resume without\ntarget reloading.\n\nReproduce steps:\n\n1. Create a cache device consisting of 1024 cache entries\n\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ndmsetup create cdata --table \"0 131072 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 262144 linear /dev/sdc 262144\"\ndd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct\ndmsetup create cache --table \"0 262144 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\"\n\n2. Populate the cache, and record the number of cached blocks\n\nfio --name=populate --filename=/dev/mapper/cache --rw=randwrite --bs=4k \\\n--size=64m --direct=1\nnr_cached=$(dmsetup status cache | awk \u0027{split($7, a, \"/\"); print a[1]}\u0027)\n\n3. Reload the cache into passthrough mode\n\ndmsetup suspend cache\ndmsetup reload cache --table \"0 262144 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0\"\ndmsetup resume cache\n\n4. Write to the passthrough cache. By setting multiple jobs with I/O\n size equal to the cache block size, cache blocks are invalidated\n concurrently from different workers.\n\nfio --filename=/dev/mapper/cache --name=test --rw=randwrite --bs=64k \\\n--direct=1 --numjobs=2 --randrepeat=0 --size=64m\n\n5. Check if demoted matches cached block count. These numbers should\n match but may differ due to the data race.\n\nnr_demoted=$(dmsetup status cache | awk \u0027{print $12}\u0027)\necho \"$nr_cached, $nr_demoted\""
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local block I/O to an existing dm-cache mapped device, such as writes from a mounted filesystem or direct writes to the block device. It is not reachable through a network packet path.\nAC:L - Once the dm-cache target is in passthrough mode with clean cached mappings, the attacker can trigger the race by issuing concurrent writes and controls both racing sides. No uncontrollable timing condition beyond ordinary concurrent I/O is required.\nPR:L - Creating or reloading the dm-cache target requires CAP_SYS_ADMIN, but in a reasonable deployed scenario an unprivileged local user with write access to a filesystem backed by the existing target can submit the writes that reach the vulnerable code. Device-mapper control ioctls are not reachable through unprivileged user namespaces.\nUI:N - The attacker only needs to issue local writes; no separate victim action is required.\nS:U - The corruption occurs inside the same kernel and block-device security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The missing locking can produce use-after-free style reuse and corruption of SMQ internal mapping structures. Following the higher-severity rule for kernel memory corruption, this is treated as capable of enabling high-impact information disclosure.\nI:H - The race can corrupt cache policy queues/hash tables and freed/reused mapping entries, affecting kernel control/data structures and potentially cache block mapping integrity. This is memory corruption/use-after-free class behavior, so high integrity impact is defensible.\nA:H - The race can trigger double-free/allocation checks, corrupted queues/hash state, NULL-deref-adjacent failures in the same passthrough write path, or kernel oops/panic. Repeated concurrent writes can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:01.533Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4991b5a08751e2e82488fb93ae08849b6aea10d9"
},
{
"url": "https://git.kernel.org/stable/c/1b2bec4a7dcf5f00b7a1cbeeec8997841d783513"
},
{
"url": "https://git.kernel.org/stable/c/9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e"
},
{
"url": "https://git.kernel.org/stable/c/ac5ee99443891bdb161f5539606a66a1b5e72542"
},
{
"url": "https://git.kernel.org/stable/c/93627a29d4b66d4a2def938dfb8610cc80ae454b"
},
{
"url": "https://git.kernel.org/stable/c/c348ae47d8e65f06429fa41adce9ad986b696766"
},
{
"url": "https://git.kernel.org/stable/c/2b62d0611c9af14a16bddf22df2612b4f40eb5a1"
},
{
"url": "https://git.kernel.org/stable/c/2d1f7b65f5deedd2e6b09fdc6ea27f8375f24b45"
}
],
"title": "dm cache policy smq: fix missing locks in invalidating cache blocks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53062",
"datePublished": "2026-06-24T16:30:06.189Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-10-19T19:47:14.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80586 (GCVE-0-2026-80586)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-10-16 19:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mptcp: options: reset DSS fields in case of unexpected size
A remote peer could send a malformed DSS with a wrong size, followed by
another DSS or MPC + Data. In this case, the first suboption will be
ignored, but leaving some fields written, which could lead to
inconsistency or access uninitialized data.
Explicitly reset the fields that could have been modified in case of
unexpected size.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 648ef4b88673dadb8463bf0d4b10fbf33d55def8 Version: 648ef4b88673dadb8463bf0d4b10fbf33d55def8 Version: 648ef4b88673dadb8463bf0d4b10fbf33d55def8 Version: 648ef4b88673dadb8463bf0d4b10fbf33d55def8 Version: 648ef4b88673dadb8463bf0d4b10fbf33d55def8 Version: 648ef4b88673dadb8463bf0d4b10fbf33d55def8 Version: 648ef4b88673dadb8463bf0d4b10fbf33d55def8 Version: 648ef4b88673dadb8463bf0d4b10fbf33d55def8 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80586",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:17:59.284912Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:28.632Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mptcp/options.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "15e35fdad7a5576bf3f1c8d688877aeb5d1b506b",
"status": "affected",
"version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
"versionType": "git"
},
{
"lessThan": "b1256090816ec46011601e084be580731df58fc7",
"status": "affected",
"version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
"versionType": "git"
},
{
"lessThan": "192878df582c51d440bf7b91a15f297f29f2b596",
"status": "affected",
"version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
"versionType": "git"
},
{
"lessThan": "26dac5c9ffb20812b475fdf253eb04fab99cff3b",
"status": "affected",
"version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
"versionType": "git"
},
{
"lessThan": "4e80eff5c1c893aca2ac1d202f0b256d2e52ecde",
"status": "affected",
"version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
"versionType": "git"
},
{
"lessThan": "1fade1b2ac5b1a4948e538fae7313bea57b5ac36",
"status": "affected",
"version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
"versionType": "git"
},
{
"lessThan": "27ed642a4e7e4b5df4b8522c72c457a67e052493",
"status": "affected",
"version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
"versionType": "git"
},
{
"lessThan": "35772b4981f38ba8059372cde8753e8e477e98ec",
"status": "affected",
"version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mptcp/options.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: options: reset DSS fields in case of unexpected size\n\nA remote peer could send a malformed DSS with a wrong size, followed by\nanother DSS or MPC + Data. In this case, the first suboption will be\nignored, but leaving some fields written, which could lead to\ninconsistency or access uninitialized data.\n\nExplicitly reset the fields that could have been modified in case of\nunexpected size."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Remote attacker sends crafted TCP segments with malformed MPTCP options that are parsed in the softirq receive path (tcp_v4_rcv/tcp_rcv_established/tcp_data_queue/mptcp_incoming_options/mptcp_get_options), requiring only network reachability to an MPTCP-enabled peer.\nAC:L - Attacker fully controls TCP option bytes on an established MPTCP connection and can deterministically send a size-invalid DSS (setting use_ack/use_map flags) immediately followed by MPC+Data or another DSS in the same header; no race or victim-specific state is required.\nPR:N - Only requires the attacker to be the remote MPTCP/TCP peer of a host with CONFIG_MPTCP enabled; no local account, capabilities, or authenticated access on the victim is needed to reach the vulnerable parser.\nUI:N - Exploitation is fully automated over the network once an MPTCP session exists; the kernel processes malicious segments in softirq without any victim user action beyond ordinary connectivity.\nS:U - Impact is limited to kernel networking/MPTCP connection state on the affected host and does not cross VM, container, or IOMMU security boundaries.\nC:H - Malformed DSS leaves use_ack/use_map/dsn64/data_fin set while data_ack and map fields are never read, so ack_update_msk() and DSS handling consume uninitialized stack values and corrupt metadata that can leak kernel memory contents.\nI:H - Stale DSS flag bits cause forged ack advancement of msk-\u003esnd_una/wnd_end/bytes_acked and bogus DATA_FIN/DSN mapping in skb extensions, corrupting rtx queues and silently altering or truncating application data delivery.\nA:H - Bogus ack state triggers __mptcp_clean_una() WARN_ON_ONCE paths outside recovery, can abort or hang MPTCP connections, and may kernel-panic systems built with panic_on_warn."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:02:07.204Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/15e35fdad7a5576bf3f1c8d688877aeb5d1b506b"
},
{
"url": "https://git.kernel.org/stable/c/b1256090816ec46011601e084be580731df58fc7"
},
{
"url": "https://git.kernel.org/stable/c/192878df582c51d440bf7b91a15f297f29f2b596"
},
{
"url": "https://git.kernel.org/stable/c/26dac5c9ffb20812b475fdf253eb04fab99cff3b"
},
{
"url": "https://git.kernel.org/stable/c/4e80eff5c1c893aca2ac1d202f0b256d2e52ecde"
},
{
"url": "https://git.kernel.org/stable/c/1fade1b2ac5b1a4948e538fae7313bea57b5ac36"
},
{
"url": "https://git.kernel.org/stable/c/27ed642a4e7e4b5df4b8522c72c457a67e052493"
},
{
"url": "https://git.kernel.org/stable/c/35772b4981f38ba8059372cde8753e8e477e98ec"
}
],
"title": "mptcp: options: reset DSS fields in case of unexpected size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80586",
"datePublished": "2026-08-26T14:37:41.493Z",
"dateReserved": "2026-08-26T14:34:25.769Z",
"dateUpdated": "2026-10-16T19:26:28.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43493 (GCVE-0-2026-43493)
Vulnerability from cvelistv5
Published
2026-05-19 10:44
Modified
2026-10-19 19:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: pcrypt - Fix handling of MAY_BACKLOG requests
MAY_BACKLOG requests can return EBUSY. Handle them by checking
for that value and filtering out EINPROGRESS notifications.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5a1436beec5744029f3ac90b6fe71a698dcd6155 Version: 5a1436beec5744029f3ac90b6fe71a698dcd6155 Version: 5a1436beec5744029f3ac90b6fe71a698dcd6155 Version: 5a1436beec5744029f3ac90b6fe71a698dcd6155 Version: 5a1436beec5744029f3ac90b6fe71a698dcd6155 Version: 5a1436beec5744029f3ac90b6fe71a698dcd6155 Version: 5a1436beec5744029f3ac90b6fe71a698dcd6155 Version: 5a1436beec5744029f3ac90b6fe71a698dcd6155 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:19:26.688Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43493",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:17:44.453814Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-390",
"description": "CWE-390 Detection of Error Condition Without Action",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:26:37.700Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/pcrypt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ae7e95638d956d556d74b9abb9e780d3bd3dcd9e",
"status": "affected",
"version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
"versionType": "git"
},
{
"lessThan": "1d7f07df450bac3301938fbc4251f2611be4084e",
"status": "affected",
"version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
"versionType": "git"
},
{
"lessThan": "76641449b28979ebd6c02e9598367e119e385236",
"status": "affected",
"version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
"versionType": "git"
},
{
"lessThan": "9f1cbca178c03188e201ed175251372149bb25f2",
"status": "affected",
"version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
"versionType": "git"
},
{
"lessThan": "eb34e243df57e32f4c08fa191f3602ea19076276",
"status": "affected",
"version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
"versionType": "git"
},
{
"lessThan": "77d55bc8675ee851ed639dc9be77325a8024cf67",
"status": "affected",
"version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
"versionType": "git"
},
{
"lessThan": "46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a",
"status": "affected",
"version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
"versionType": "git"
},
{
"lessThan": "915b692e6cb723aac658c25eb82c58fd81235110",
"status": "affected",
"version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/pcrypt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - Fix handling of MAY_BACKLOG requests\n\nMAY_BACKLOG requests can return EBUSY. Handle them by checking\nfor that value and filtering out EINPROGRESS notifications."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - pcrypt AEAD can sit under network-facing kernel crypto consumers such as kTLS/TIPC that process peer-supplied records or packets. In the highest reasonable deployment, a remote peer can drive the vulnerable encrypt/decrypt path through network traffic.\nAC:L - The trigger is child crypto backlog behavior under `CRYPTO_TFM_REQ_MAY_BACKLOG`; an attacker can induce queue pressure with concurrent requests or traffic. There is no race that depends on conditions outside the attacker\u0027s control.\nPR:N - The network-facing path requires no kernel privileges from the remote peer. The local AF_ALG AEAD path also has no capability gate, but the higher-severity network scenario is defensible.\nUI:N - No victim interaction is required once the affected crypto consumer is configured. The attacker only sends data or submits crypto requests.\nS:U - The bug corrupts kernel crypto/request state within the same kernel security authority. It is not a VM escape, IOMMU bypass, or other scope-changing boundary crossing.\nC:H - Mishandling `-EBUSY` can complete and free the request while the child request remains queued, leading to use-after-free on later callbacks. A kernel UAF is reasonably exploitable for high-impact information disclosure.\nI:H - The stale callback reuses freed request/padata memory and can drive list operations and completion paths on attacker-reclaimed objects. This is memory corruption with a plausible path to arbitrary write or control-flow corruption.\nA:H - At minimum, the premature completion and later queued callback can dereference or manipulate freed kernel memory. That can produce kernel oops/panic or list corruption, giving high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:16.602Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ae7e95638d956d556d74b9abb9e780d3bd3dcd9e"
},
{
"url": "https://git.kernel.org/stable/c/1d7f07df450bac3301938fbc4251f2611be4084e"
},
{
"url": "https://git.kernel.org/stable/c/76641449b28979ebd6c02e9598367e119e385236"
},
{
"url": "https://git.kernel.org/stable/c/9f1cbca178c03188e201ed175251372149bb25f2"
},
{
"url": "https://git.kernel.org/stable/c/eb34e243df57e32f4c08fa191f3602ea19076276"
},
{
"url": "https://git.kernel.org/stable/c/77d55bc8675ee851ed639dc9be77325a8024cf67"
},
{
"url": "https://git.kernel.org/stable/c/46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a"
},
{
"url": "https://git.kernel.org/stable/c/915b692e6cb723aac658c25eb82c58fd81235110"
}
],
"title": "crypto: pcrypt - Fix handling of MAY_BACKLOG requests",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43493",
"datePublished": "2026-05-19T10:44:25.402Z",
"dateReserved": "2026-05-01T14:12:56.013Z",
"dateUpdated": "2026-10-19T19:26:37.700Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89603 (GCVE-0-2026-89603)
Vulnerability from cvelistv5
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2026-10-16T06:29:42.006Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"rejectedReasons": [
{
"lang": "en",
"value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89603",
"datePublished": "2026-09-11T19:45:06.613Z",
"dateRejected": "2026-10-16T06:29:42.006Z",
"dateReserved": "2026-09-11T19:38:34.732Z",
"dateUpdated": "2026-10-16T06:29:42.006Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63984 (GCVE-0-2026-63984)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-10-19 20:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
ipv6_rpl_srh_decompress() computes:
outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3);
hdrlen is __u8. For n >= 127 the result exceeds 255 and silently
truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16):
(128 * 16) >> 3 = 256, truncated to 0 as __u8
The caller in ipv6_rpl_srh_rcv() then places the compressed header
at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8,
but the decompressed region occupies buf[0..2055] (8-byte header
plus 128 full addresses). The compressed header overlaps the
decompressed data, and ipv6_rpl_srh_compress() writes into this
overlap, corrupting the routing header of the forwarded packet.
The existing guard at exthdrs.c:546 checks (n + 1) > 255, which
prevents n+1 from overflowing unsigned char (the segments_left
field), but does not prevent the computed hdrlen from overflowing
__u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not
fit.
Tighten the bound to (n + 1) > 127. This caps n at 126, giving
hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed
header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly
past the decompressed region (buf[0..2039]). No overlap. 127
segments is well beyond any realistic RPL deployment.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 Version: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 Version: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 Version: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 Version: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 Version: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 Version: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 Version: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63984",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:34:39.184194Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:18:00.765Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/exthdrs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "75b3680047bf09af8e7e471a7a6ddf2ce5847f56",
"status": "affected",
"version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
"versionType": "git"
},
{
"lessThan": "fd238c51b0fa5390cceca9f1ac5a9ffda8063eed",
"status": "affected",
"version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
"versionType": "git"
},
{
"lessThan": "3618b34942b76471d044369bfd30d58c39068bf1",
"status": "affected",
"version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
"versionType": "git"
},
{
"lessThan": "97e06791368c01f0ad2a4b3269c2abe19485ca32",
"status": "affected",
"version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
"versionType": "git"
},
{
"lessThan": "de02fc049352af5a9595f015511222d0a85c326b",
"status": "affected",
"version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
"versionType": "git"
},
{
"lessThan": "6fe1cb312038516cb4d9fa089d700af7059f1a64",
"status": "affected",
"version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
"versionType": "git"
},
{
"lessThan": "c0487a9c1e116cf349e2d1f302d9019670460858",
"status": "affected",
"version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
"versionType": "git"
},
{
"lessThan": "9d5e7a46a9f6d8f503b41bfefef70659845f1679",
"status": "affected",
"version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/exthdrs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()\n\nipv6_rpl_srh_decompress() computes:\n\n outhdr-\u003ehdrlen = (((n + 1) * sizeof(struct in6_addr)) \u003e\u003e 3);\n\nhdrlen is __u8. For n \u003e= 127 the result exceeds 255 and silently\ntruncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16):\n\n (128 * 16) \u003e\u003e 3 = 256, truncated to 0 as __u8\n\nThe caller in ipv6_rpl_srh_rcv() then places the compressed header\nat buf + ((ohdr-\u003ehdrlen + 1) \u003c\u003c 3). With hdrlen=0 this is buf + 8,\nbut the decompressed region occupies buf[0..2055] (8-byte header\nplus 128 full addresses). The compressed header overlaps the\ndecompressed data, and ipv6_rpl_srh_compress() writes into this\noverlap, corrupting the routing header of the forwarded packet.\n\nThe existing guard at exthdrs.c:546 checks (n + 1) \u003e 255, which\nprevents n+1 from overflowing unsigned char (the segments_left\nfield), but does not prevent the computed hdrlen from overflowing\n__u8. n=127 passes because 128 \u003c= 255, yet hdrlen=256 does not\nfit.\n\nTighten the bound to (n + 1) \u003e 127. This caps n at 126, giving\nhdrlen = (127 * 16) \u003e\u003e 3 = 254, which fits in __u8. The compressed\nheader then lands at buf + ((254 + 1) \u003c\u003c 3) = buf + 2040, exactly\npast the decompressed region (buf[0..2039]). No overlap. 127\nsegments is well beyond any realistic RPL deployment."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code runs in the IPv6 routing-header receive handler on incoming packets; a remote attacker can deliver a crafted RFC 6554 type-3 RPL SRH to an RPL-enabled router or gateway over the network.\nAC:L - Triggering requires only a deterministically crafted SRH (e.g., n=127, CmprI=15, CmprE=15, pad=0, hdrlen=16, segments_left\u003e0); all of these fields are fully attacker-controlled once the target has rpl_seg_enabled.\nPR:N - No authentication or local privileges are needed to send the malicious IPv6 packet; rpl_seg_enabled is a victim-side deployment setting on RPL routers/gateways (IoT/industrial mesh), not an attacker privilege requirement.\nUI:N - Exploitation is achieved solely by sending a malformed network packet and does not require any action from a victim user.\nS:U - Impact is confined to kernel memory corruption and packet forwarding within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The hdrlen truncation causes overlapping read/write of the same kmalloc buffer during decompress/recompress, constituting kernel heap memory corruption that can be leveraged for information disclosure primitives.\nI:H - ipv6_rpl_srh_compress() performs out-of-bounds writes into the overlapping decompressed region, corrupting routing-header data that is then memcpy\u0027d into the forwarded skb, enabling memory corruption exploitable for control-flow or data modification.\nA:H - Kernel heap corruption during SRH processing can cause kernel oops, panics, or repeated crashes when processing or forwarding the corrupted packet, consistent with high availability impact for memory-corruption bugs."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:52.442Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/75b3680047bf09af8e7e471a7a6ddf2ce5847f56"
},
{
"url": "https://git.kernel.org/stable/c/fd238c51b0fa5390cceca9f1ac5a9ffda8063eed"
},
{
"url": "https://git.kernel.org/stable/c/3618b34942b76471d044369bfd30d58c39068bf1"
},
{
"url": "https://git.kernel.org/stable/c/97e06791368c01f0ad2a4b3269c2abe19485ca32"
},
{
"url": "https://git.kernel.org/stable/c/de02fc049352af5a9595f015511222d0a85c326b"
},
{
"url": "https://git.kernel.org/stable/c/6fe1cb312038516cb4d9fa089d700af7059f1a64"
},
{
"url": "https://git.kernel.org/stable/c/c0487a9c1e116cf349e2d1f302d9019670460858"
},
{
"url": "https://git.kernel.org/stable/c/9d5e7a46a9f6d8f503b41bfefef70659845f1679"
}
],
"title": "ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63984",
"datePublished": "2026-07-19T14:56:06.786Z",
"dateReserved": "2026-07-19T07:54:57.025Z",
"dateUpdated": "2026-10-19T20:18:00.765Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68451 (GCVE-0-2026-68451)
Vulnerability from cvelistv5
Published
2026-08-13 13:59
Modified
2026-10-19 21:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Validate length for CCA ECC private key requests
cca_ecc2protkey() derives the copy length for the CPRB parameter
block directly from the length field in the key token. Reject the
request early if the token length exceeds the available space in the
parameter block.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 Version: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 Version: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 Version: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 Version: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 Version: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 Version: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 Version: fa6999e326fe7851ecbd572b8cb9be8e930ebf41 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68451",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:49:11.874669Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:10.945Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_ccamisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7dc306ff7c4d951582adaae65e0aee9fb4968dbe",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
},
{
"lessThan": "447a37a6bef11bfd3645069e380460b11386e2b9",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
},
{
"lessThan": "f0831f13c42c1261d449dcee8a035e1c6cd9fcaa",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
},
{
"lessThan": "dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
},
{
"lessThan": "ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
},
{
"lessThan": "013a4484f061a2b41f052e25c0015203287e63f1",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
},
{
"lessThan": "8fa3e9435a13c335efb63fb4f4e77531a0031159",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
},
{
"lessThan": "a9ae0f6dd45c3ccc1d69363f7aea8af179122730",
"status": "affected",
"version": "fa6999e326fe7851ecbd572b8cb9be8e930ebf41",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_ccamisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Validate length for CCA ECC private key requests\n\ncca_ecc2protkey() derives the copy length for the CPRB parameter\nblock directly from the length field in the key token. Reject the\nrequest early if the token length exceeds the available space in the\nparameter block."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached through the `/dev/pkey` misc device via the PKEY_KBLOB2PROTK/PROTK2/PROTK3 ioctls, requiring local access to the s390 system; there is no remote or network-facing path into cca_ecc2protkey().\nAC:L - The attacker fully controls both the overflow length and the overflowing bytes by crafting the ECC key token\u0027s `len` field and blob contents, and the memcpy executes deterministically on every call with no race, timing, or layout precondition.\nPR:L - The pkey misc device is registered with mode 0666 and pkey_unlocked_ioctl performs no capability check, so any unprivileged local user (or a container/sandbox process with the node visible) can issue the ioctl.\nUI:N - The attacker triggers the overflow entirely from its own ioctl call; no action by another user or administrator is needed.\nS:U - The heap corruption occurs in kernel memory within the same security authority; no VM, IOMMU, or other trust boundary is crossed by the overflow itself.\nC:H - The controlled slab overflow can overwrite adjacent kernel objects (pointers, lengths, credentials) with attacker-chosen data, which is readily leveraged into arbitrary kernel memory disclosure, including protected/secure key material handled by this subsystem.\nI:H - memcpy() writes up to ~7 KB of fully attacker-controlled data past a kmalloc\u0027d CPRB buffer, giving a classic controlled heap out-of-bounds write usable for corrupting neighbouring slab objects and achieving privilege escalation or control-flow hijack.\nA:H - Even without reliable exploitation, the oversized memcpy smashes the slab and neighbouring allocations, causing memory corruption, SLUB/redzone BUG detonations, oops or kernel panic, repeatedly triggerable by an unprivileged user."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:35:48.084Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7dc306ff7c4d951582adaae65e0aee9fb4968dbe"
},
{
"url": "https://git.kernel.org/stable/c/447a37a6bef11bfd3645069e380460b11386e2b9"
},
{
"url": "https://git.kernel.org/stable/c/f0831f13c42c1261d449dcee8a035e1c6cd9fcaa"
},
{
"url": "https://git.kernel.org/stable/c/dd25bd9b0f36849808bd7625dcc59dd4c1aeef3e"
},
{
"url": "https://git.kernel.org/stable/c/ecc3b8691c1935f9f3e4eb964ab11e40fdec17f5"
},
{
"url": "https://git.kernel.org/stable/c/013a4484f061a2b41f052e25c0015203287e63f1"
},
{
"url": "https://git.kernel.org/stable/c/8fa3e9435a13c335efb63fb4f4e77531a0031159"
},
{
"url": "https://git.kernel.org/stable/c/a9ae0f6dd45c3ccc1d69363f7aea8af179122730"
}
],
"title": "s390/zcrypt: Validate length for CCA ECC private key requests",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68451",
"datePublished": "2026-08-13T13:59:53.674Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-10-19T21:09:10.945Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68452 (GCVE-0-2026-68452)
Vulnerability from cvelistv5
Published
2026-08-13 13:59
Modified
2026-10-19 21:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Validate length for CCA AES cipher key requests
cca_cipher2protkey() derives the copy length for the CPRB parameter
block directly from the length field in the key token. Reject the
request early if the token length exceeds the available space in the
parameter block.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd Version: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd Version: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd Version: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd Version: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd Version: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd Version: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd Version: 4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68452",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:49:15.916334Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:11.097Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_ccamisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "be037204e4f595e4bd2159acda146677a1dc6342",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "4e500ecb6704d879f9c2417c2ed6faba595015ca",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "7f9e5a3dbb14a9b321a1dfa30390402c673f82dc",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "406b317ea2b501f6f5eca1264293c9399a73a778",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "4fc46deceda076d429ef3fab2ccf8d96629ebd23",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "ad93a1f1a45652478c0cf4eb029114e03af57f3b",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "3859f630b674801a00bca39bc451f52288591f65",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
},
{
"lessThan": "06afe425d5283b9764303de47f554da5a808ce8a",
"status": "affected",
"version": "4bc123b18ce6ae6c42c69d0456b5acbd2f7bc8bd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_ccamisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Validate length for CCA AES cipher key requests\n\ncca_cipher2protkey() derives the copy length for the CPRB parameter\nblock directly from the length field in the key token. Reject the\nrequest early if the token length exceeds the available space in the\nparameter block."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached through an ioctl (PKEY_KBLOB2PROTK2/3) on the /dev/pkey character device, requiring local access to the s390 system; there is no remote or adjacent-network path to cca_cipher2protkey().\nAC:L - The overflow is fully deterministic: the attacker sets the token\u0027s len field to any value up to the 8192-byte ioctl limit and the memcpy into the 512-byte parameter block happens unconditionally, before any crypto card interaction, with no race or unknown state involved.\nPR:L - The pkey misc device is registered with .mode = 0666 and neither pkey_api.c, pkey_base.c nor pkey_cca.c performs any capable()/CAP_* check, so any unprivileged local user can open it and issue the key-to-protkey ioctl.\nUI:N - The attacker triggers the overflow entirely on its own by issuing the ioctl with a crafted CCA AES cipher key token; no victim action or cooperation is needed.\nS:U - The heap corruption occurs in kernel slab memory managed by the same kernel security authority as the calling process; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The controlled slab overflow (up to ~7.6 KB past a kmalloc-2k object) lets the attacker overwrite adjacent kernel objects, and the corrupted CPRB/reply buffer is subsequently parsed and partially copied back to userspace, giving a path to disclosing arbitrary kernel memory.\nI:H - memcpy() writes attacker-chosen token bytes far beyond the 512-byte parameter block, an out-of-bounds heap write with attacker-controlled length and contents, which is a classic primitive for corrupting neighbouring slab objects and hijacking control flow.\nA:H - Overwriting several kilobytes of adjacent slab memory reliably corrupts unrelated kernel objects and slab metadata, causing oopses or a panic; the ioctl can be repeated at will by any local user."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:35:50.661Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/be037204e4f595e4bd2159acda146677a1dc6342"
},
{
"url": "https://git.kernel.org/stable/c/4e500ecb6704d879f9c2417c2ed6faba595015ca"
},
{
"url": "https://git.kernel.org/stable/c/7f9e5a3dbb14a9b321a1dfa30390402c673f82dc"
},
{
"url": "https://git.kernel.org/stable/c/406b317ea2b501f6f5eca1264293c9399a73a778"
},
{
"url": "https://git.kernel.org/stable/c/4fc46deceda076d429ef3fab2ccf8d96629ebd23"
},
{
"url": "https://git.kernel.org/stable/c/ad93a1f1a45652478c0cf4eb029114e03af57f3b"
},
{
"url": "https://git.kernel.org/stable/c/3859f630b674801a00bca39bc451f52288591f65"
},
{
"url": "https://git.kernel.org/stable/c/06afe425d5283b9764303de47f554da5a808ce8a"
}
],
"title": "s390/zcrypt: Validate length for CCA AES cipher key requests",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68452",
"datePublished": "2026-08-13T13:59:54.840Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-10-19T21:09:11.097Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98725 (GCVE-0-2026-98725)
Vulnerability from cvelistv5
Published
2026-10-18 15:47
Modified
2026-10-30 12:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
nvmet_auth_challenge() receives its output buffer as a void pointer.
sizeof(*d) therefore evaluates to one with GCC and undercounts the fixed
challenge header by 15 bytes. A short AUTH_RECEIVE buffer can pass the
check before the challenge is copied past the end of its allocation.
Use the typed challenge pointer when calculating the response size.
BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)
Write of size 32 by task kworker/1:1H/64
Workqueue: nvmet_tcp_wq nvmet_tcp_io_work
Call Trace:
nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)
nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243)
nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445)
process_one_work (kernel/workqueue.c:3322)
worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
The buggy address is located 16 bytes inside of
allocated 33-byte region [ffff888000554e80, ffff888000554ea1)
Kernel panic - not syncing: KASAN: panic_on_warn set ...
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: db1312dd95488b5e6ff362ff66fcf953a46b1821 Version: db1312dd95488b5e6ff362ff66fcf953a46b1821 Version: db1312dd95488b5e6ff362ff66fcf953a46b1821 Version: db1312dd95488b5e6ff362ff66fcf953a46b1821 Version: db1312dd95488b5e6ff362ff66fcf953a46b1821 Version: db1312dd95488b5e6ff362ff66fcf953a46b1821 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/fabrics-cmd-auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e94ff1771c4cb398749789557f0b6feb871e3486",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "ef4dfad231a787aded76e5b03788ddb18c8aebab",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "9d61131acd742cf97ee64e453383e41b46568513",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "8a9b4c0eef19c207663c1ee888257307c869ca86",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "fa6778e030bed9841ddcdf96bc7018da9ac03562",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/fabrics-cmd-auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()\n\nnvmet_auth_challenge() receives its output buffer as a void pointer.\nsizeof(*d) therefore evaluates to one with GCC and undercounts the fixed\nchallenge header by 15 bytes. A short AUTH_RECEIVE buffer can pass the\ncheck before the challenge is copied past the end of its allocation.\n\nUse the typed challenge pointer when calculating the response size.\n\n BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n Write of size 32 by task kworker/1:1H/64\n Workqueue: nvmet_tcp_wq nvmet_tcp_io_work\n Call Trace:\n nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)\n nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243)\n nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445)\n process_one_work (kernel/workqueue.c:3322)\n worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:158)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n The buggy address is located 16 bytes inside of\n allocated 33-byte region [ffff888000554e80, ffff888000554ea1)\n Kernel panic - not syncing: KASAN: panic_on_warn set ..."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:39:06.682Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e94ff1771c4cb398749789557f0b6feb871e3486"
},
{
"url": "https://git.kernel.org/stable/c/ef4dfad231a787aded76e5b03788ddb18c8aebab"
},
{
"url": "https://git.kernel.org/stable/c/9d61131acd742cf97ee64e453383e41b46568513"
},
{
"url": "https://git.kernel.org/stable/c/7fd3c363eba4f2aceb4b3f31cd1cf65e0dcbaee4"
},
{
"url": "https://git.kernel.org/stable/c/8a9b4c0eef19c207663c1ee888257307c869ca86"
},
{
"url": "https://git.kernel.org/stable/c/fa6778e030bed9841ddcdf96bc7018da9ac03562"
}
],
"title": "nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98725",
"datePublished": "2026-10-18T15:47:02.735Z",
"dateReserved": "2026-09-25T10:25:14.366Z",
"dateUpdated": "2026-10-30T12:39:06.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72221 (GCVE-0-2026-72221)
Vulnerability from cvelistv5
Published
2026-08-15 05:54
Modified
2026-10-16 18:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: wait for in-flight TLS handshake callback when cancel loses race
When wait_for_completion_interruptible_timeout() in
svc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) and
tls_handshake_cancel() then returns false, handshake_complete() has
won the cancellation race: it has set HANDSHAKE_F_REQ_COMPLETED and
is about to invoke svc_tcp_handshake_done(), but the callback's
side effects on xpt_flags and on svsk->sk_handshake_done have not
yet committed.
The current code reads xpt_flags immediately to decide whether the
session succeeded. Two races result.
If the callback has executed set_bit(XPT_TLS_SESSION) but not yet
clear_bit(XPT_HANDSHAKE), svc_tcp_handshake() sees a session,
enqueues the transport, and returns. svc_xprt_received() then
clears XPT_BUSY, a worker thread picks the transport up, the
dispatcher in svc_handle_xprt() observes XPT_HANDSHAKE still set,
and xpo_handshake is invoked a second time. That svc_tcp_handshake()
calls init_completion(&svsk->sk_handshake_done) while the original
callback concurrently calls complete_all() on it, corrupting the
embedded swait_queue.
If the callback has set HANDSHAKE_F_REQ_COMPLETED but not yet
entered svc_tcp_handshake_done(), svc_tcp_handshake() reads
XPT_TLS_SESSION as clear and tears the connection down even though
the handshake is about to succeed.
Wait for the callback to commit before inspecting xpt_flags. The
completion is guaranteed to fire because handshake_complete()
invokes svc_tcp_handshake_done() unconditionally once it has set
HANDSHAKE_F_REQ_COMPLETED.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72221",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:43:57.343257Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:45:02.148Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/svcsock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0d8ceb39884148dc7a2fdf71e1cac5961ed1d2b9",
"status": "affected",
"version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
"versionType": "git"
},
{
"lessThan": "e0f4691d42a54d359d8b64509fd9ab938d4f2a33",
"status": "affected",
"version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
"versionType": "git"
},
{
"lessThan": "65b23bec1fca6e9ebdc3e6041ebf8c6ab074141b",
"status": "affected",
"version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
"versionType": "git"
},
{
"lessThan": "a4f878e8ecd729ccf2e50993444e217583adeace",
"status": "affected",
"version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
"versionType": "git"
},
{
"lessThan": "d00e32f84ca1a77cb67a3fbf59f58dada95f5a21",
"status": "affected",
"version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/svcsock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: wait for in-flight TLS handshake callback when cancel loses race\n\nWhen wait_for_completion_interruptible_timeout() in\nsvc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) and\ntls_handshake_cancel() then returns false, handshake_complete() has\nwon the cancellation race: it has set HANDSHAKE_F_REQ_COMPLETED and\nis about to invoke svc_tcp_handshake_done(), but the callback\u0027s\nside effects on xpt_flags and on svsk-\u003esk_handshake_done have not\nyet committed.\n\nThe current code reads xpt_flags immediately to decide whether the\nsession succeeded. Two races result.\n\nIf the callback has executed set_bit(XPT_TLS_SESSION) but not yet\nclear_bit(XPT_HANDSHAKE), svc_tcp_handshake() sees a session,\nenqueues the transport, and returns. svc_xprt_received() then\nclears XPT_BUSY, a worker thread picks the transport up, the\ndispatcher in svc_handle_xprt() observes XPT_HANDSHAKE still set,\nand xpo_handshake is invoked a second time. That svc_tcp_handshake()\ncalls init_completion(\u0026svsk-\u003esk_handshake_done) while the original\ncallback concurrently calls complete_all() on it, corrupting the\nembedded swait_queue.\n\nIf the callback has set HANDSHAKE_F_REQ_COMPLETED but not yet\nentered svc_tcp_handshake_done(), svc_tcp_handshake() reads\nXPT_TLS_SESSION as clear and tears the connection down even though\nthe handshake is about to succeed.\n\nWait for the callback to commit before inspecting xpt_flags. The\ncompletion is guaranteed to fire because handshake_complete()\ninvokes svc_tcp_handshake_done() unconditionally once it has set\nHANDSHAKE_F_REQ_COMPLETED."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Reachable over TCP by any remote peer of an in-kernel NFS/RPC server (nfsd) via the pre-auth RPC_AUTH_TLS NULL-procedure STARTTLS path that invokes svc_tcp_handshake() on the accepted SUNRPC transport.\nAC:L - The attacker controls both sides of the race by timing TLS client handshake messages against the fixed 5-second SVC_HANDSHAKE_TO and opening many parallel connections to reliably hit the cancel-lost window.\nPR:N - No credentials or export authorization are required; svcauth_tls_accept() accepts empty AUTH_TLS on RPC NULL from any TCP client, and svcauth_unix_set_client() skips IP export checks when rq_proc==0.\nUI:N - Exploitation requires only scripted network connections and TLS client traffic to nfsd; no victim user interaction such as mounting a filesystem or opening a file is needed.\nS:U - Memory corruption occurs in nfsd kernel worker context on the same host; impact is kernel privilege compromise within the server security authority, not a VM escape or IOMMU boundary bypass.\nC:H - A second svc_tcp_handshake() can call init_completion() while svc_tcp_handshake_done() concurrently calls complete_all(), corrupting the embedded swait_queue in heap-allocated svc_sock and enabling arbitrary kernel memory disclosure.\nI:H - Corrupting completion wait-queue metadata in the svc_sock heap object can be leveraged for arbitrary kernel writes and control-flow hijacking to achieve local privilege escalation on the NFS server.\nA:H - The swait_queue corruption can trigger kernel oops/panic, and the alternate race path tears down connections whose TLS handshake is about to succeed, enabling repeatable remote denial-of-service against nfsd."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:41:42.766Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0d8ceb39884148dc7a2fdf71e1cac5961ed1d2b9"
},
{
"url": "https://git.kernel.org/stable/c/e0f4691d42a54d359d8b64509fd9ab938d4f2a33"
},
{
"url": "https://git.kernel.org/stable/c/65b23bec1fca6e9ebdc3e6041ebf8c6ab074141b"
},
{
"url": "https://git.kernel.org/stable/c/a4f878e8ecd729ccf2e50993444e217583adeace"
},
{
"url": "https://git.kernel.org/stable/c/d00e32f84ca1a77cb67a3fbf59f58dada95f5a21"
}
],
"title": "sunrpc: wait for in-flight TLS handshake callback when cancel loses race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72221",
"datePublished": "2026-08-15T05:54:14.539Z",
"dateReserved": "2026-08-09T03:40:39.913Z",
"dateUpdated": "2026-10-16T18:45:02.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99999 (GCVE-0-2026-99999)
Vulnerability from cvelistv5
Published
2026-10-15 12:19
Modified
2026-10-24 14:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: validate checksum_start before completing checksum
If a packet with bad checksum metadata gets into the ipv4 stack,
skb_checksum_help can corrupt the network header and cause a bunch of
mischief.
This was discovered and reported by Paulos, and has been reporoduced
by others independently since.
We really shouldn't allow such packets in, but as a defence
in depth measure, let's also check before we complete the checksum.
A more complete validation at input is forthcoming, but needs more work.
References
| URL | Tags | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 |
||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-15T22:07:24.590Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/15/5"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-99999",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:49:03.519458Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:19:28.844Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/ip.h",
"net/bridge/netfilter/nf_conntrack_bridge.c",
"net/ipv4/ip_output.c",
"net/netfilter/nfnetlink_queue.c",
"net/netfilter/xt_CHECKSUM.c",
"net/xfrm/xfrm_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a464d950f31c89565cbaae038cc60db04fe01956",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "0fab003ef4698e0628060a45a48f14b43ba2a40a",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "94524b7b32691de2e2ce162c04d6cbc9106e5cbf",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "a65f69e0f38ffbed1b128029e09097436416dc8b",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "32a8b0adaa18e52aaa0b246b5ffe683075354dbb",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "f3e835af6226f1dd12160cbd696081e9b6155de0",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "c3e33464746166264334641dc850a36eef7e6326",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "6785011f8b16abf40b1e9d8b2e332232b3e68822",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/ip.h",
"net/bridge/netfilter/nf_conntrack_bridge.c",
"net/ipv4/ip_output.c",
"net/netfilter/nfnetlink_queue.c",
"net/netfilter/xt_CHECKSUM.c",
"net/xfrm/xfrm_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.272",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.223",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.190",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.159",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.272",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.223",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.190",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.159",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn\u0027t allow such packets in, but as a defence\nin depth measure, let\u0027s also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - A malicious microVM supplies crafted virtio-net checksum metadata with its outbound frame. The VMM writes it to the host TAP, where tun_get_user() feeds the skb to the IPv4 stack and ip_do_fragment() calls skb_checksum_help(); this is a guest/local virtual-device path, not an Internet receive path.\nAC:L - The guest controls the frame, checksum start and offset, and packet size and can repeat the same fragmentation sequence. No race, timing window, or uncontrollable memory layout is needed; host leak, crash, and code-execution variants were reproduced with crafted packets.\nPR:N - In the microVM scenario, a tenant workload able to transmit through its assigned virtio-net interface can supply the triggering traffic. It needs no host credentials, capability, or access to /dev/net/tun; the privileged VMM merely forwards guest output to its existing TAP fd.\nUI:N - The attacker sends the crafted guest packets directly, and host TAP/IPv4 processing invokes checksum completion automatically. No host administrator or other victim must act.\nS:C - The checksum metadata originates in an untrusted microVM, but skb_checksum_help() and ip_do_fragment() process and corrupt state in the host kernel. The demonstrated leak, crash, and administrator code execution cross the guest-to-host isolation boundary.\nC:H - After skb_checksum_help() changes an already-validated IPv4 IHL, ip_do_fragment() trusts the new length and ip_frag_next() copies beyond the skb\u0027s logical linear head into transmitted IPv4 options. This was demonstrated as continuous host-memory disclosure in guest-emitted packets.\nI:H - skb_checksum_help() writes at the attacker-controlled checksum position inside an IPv4 header after routing and validation, and downstream code trusts the modified fields. Crafted guest packets using this flaw were demonstrated to execute commands with full administrator privileges on the host.\nA:H - Malformed checksum offsets reach skb_checksum_help() from IPv4 fragmentation and can trip WARN_ONCE/panic paths or poison the header geometry used downstream. Crafted guest packets were demonstrated to crash the physical host, taking down all sandboxes on it."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:17:15.740Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956"
},
{
"url": "https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a"
},
{
"url": "https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf"
},
{
"url": "https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b"
},
{
"url": "https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb"
},
{
"url": "https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0"
},
{
"url": "https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326"
},
{
"url": "https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822"
},
{
"url": "https://pwn.ai/blog/pwnescape"
},
{
"url": "https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge"
}
],
"title": "ipv4: validate checksum_start before completing checksum",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99999",
"datePublished": "2026-10-15T12:19:22.784Z",
"dateReserved": "2026-09-25T10:25:14.451Z",
"dateUpdated": "2026-10-24T14:17:15.740Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68159 (GCVE-0-2026-68159)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
__decode_pg_temp() decodes an user-controlled length but only rejects
values large enough to overflow the allocation; it does not bound it to
CEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and
apply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size
on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends
an OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack
out-of-bounds write.
An OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer
entries at decode time. The bound is well below the old overflow threshold, so
it also covers the allocation-size overflow the previous check guarded against.
BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds
Write of size 4 ... by task exploit
kasan_report (mm/kasan/report.c:595)
ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833)
calc_target (net/ceph/osd_client.c:1638)
__submit_request (net/ceph/osd_client.c:2394)
ceph_osdc_start_request (net/ceph/osd_client.c:2490)
ceph_osdc_call (net/ceph/osd_client.c:5164)
rbd_dev_image_probe (drivers/block/rbd.c:6899)
do_rbd_add (drivers/block/rbd.c:7138)
...
kernel BUG at net/ceph/osdmap.c:2670!
[ idryomov: do the same in __decode_pg_upmap_items() ]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a303bb0e58345fe9f7ab2f82b90266f2b5036058 Version: a303bb0e58345fe9f7ab2f82b90266f2b5036058 Version: a303bb0e58345fe9f7ab2f82b90266f2b5036058 Version: a303bb0e58345fe9f7ab2f82b90266f2b5036058 Version: a303bb0e58345fe9f7ab2f82b90266f2b5036058 Version: a303bb0e58345fe9f7ab2f82b90266f2b5036058 Version: a303bb0e58345fe9f7ab2f82b90266f2b5036058 Version: a303bb0e58345fe9f7ab2f82b90266f2b5036058 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68159",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:45:17.609836Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:55.255Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "66eec4af1e080b695229c9a20635648a6d12fedf",
"status": "affected",
"version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
"versionType": "git"
},
{
"lessThan": "4daf06456677177f2a6044729abac59c1b49e87b",
"status": "affected",
"version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
"versionType": "git"
},
{
"lessThan": "d5650ddbd4d42c1a916c8fe1a4c4cb573ef810a1",
"status": "affected",
"version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
"versionType": "git"
},
{
"lessThan": "42bc06c67d94d5f2a6b33294b0c4b07d8a47c515",
"status": "affected",
"version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
"versionType": "git"
},
{
"lessThan": "ebdf4b4f3b1474079980a2e5cd79ad65fb54db57",
"status": "affected",
"version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
"versionType": "git"
},
{
"lessThan": "590b07ceea138d49c9b64f65d263aa902d3b4730",
"status": "affected",
"version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
"versionType": "git"
},
{
"lessThan": "e36663145abd7024f0281dfb22fdef65f185845b",
"status": "affected",
"version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
"versionType": "git"
},
{
"lessThan": "9f00f9cf2be293efe899db67dc5272e3a9c62717",
"status": "affected",
"version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE\n\n__decode_pg_temp() decodes an user-controlled length but only rejects\nvalues large enough to overflow the allocation; it does not bound it to\nCEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and\napply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size\non-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends\nan OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack\nout-of-bounds write.\n\nAn OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer\nentries at decode time. The bound is well below the old overflow threshold, so\nit also covers the allocation-size overflow the previous check guarded against.\n\n BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds\n Write of size 4 ... by task exploit\n kasan_report (mm/kasan/report.c:595)\n ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833)\n calc_target (net/ceph/osd_client.c:1638)\n __submit_request (net/ceph/osd_client.c:2394)\n ceph_osdc_start_request (net/ceph/osd_client.c:2490)\n ceph_osdc_call (net/ceph/osd_client.c:5164)\n rbd_dev_image_probe (drivers/block/rbd.c:6899)\n do_rbd_add (drivers/block/rbd.c:7138)\n ...\n kernel BUG at net/ceph/osdmap.c:2670!\n\n[ idryomov: do the same in __decode_pg_upmap_items() ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Malicious pg_temp/pg_upmap data arrives in CEPH_MSG_OSD_MAP from a Ceph monitor or OSD over TCP, is decoded in libceph, and later triggers stack corruption in ceph_pg_to_up_acting_osds during RBD/CephFS/libceph client I/O.\nAC:L - A compromised or attacker-controlled monitor can publish osdmap entries with length \u003e32 for chosen PGs; once the client subscribes, kernel I/O paths such as RBD mount/probe via calc_target deterministically invoke apply_upmap/get_temp_osds and overflow the stack buffer.\nPR:N - Exploitation requires no privileges on the victim host; any machine acting as a Ceph client that receives a forged osdmap from a cluster peer over the network can be attacked without local user capabilities or namespace tricks.\nUI:N - No victim user action is needed during exploitation beyond the host already being a Ceph client; forged osdmaps are applied automatically and the overflow fires on subsequent kernel client operations without interactive steps.\nS:U - Impact is confined to kernel memory on the Ceph client host (privilege escalation or crash); it does not cross VM, IOMMU, or sandbox boundaries to other security authorities.\nC:H - KASAN-confirmed stack out-of-bounds write in ceph_pg_to_up_acting_osds corrupts adjacent stack memory and can be leveraged for arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - Unbounded copy loops in apply_upmap() and get_temp_osds() write attacker-controlled u32 OSD IDs past the fixed osds[CEPH_PG_MAX_SIZE] stack array, enabling control-flow hijack and arbitrary kernel writes.\nA:H - The reported reproducer triggers KASAN stack-out-of-bounds followed by kernel BUG in ceph_pg_to_up_acting_osds, demonstrating a reliable kernel oops or panic from malformed osdmap processing on Ceph clients."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:46:00.131Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/66eec4af1e080b695229c9a20635648a6d12fedf"
},
{
"url": "https://git.kernel.org/stable/c/4daf06456677177f2a6044729abac59c1b49e87b"
},
{
"url": "https://git.kernel.org/stable/c/d5650ddbd4d42c1a916c8fe1a4c4cb573ef810a1"
},
{
"url": "https://git.kernel.org/stable/c/42bc06c67d94d5f2a6b33294b0c4b07d8a47c515"
},
{
"url": "https://git.kernel.org/stable/c/ebdf4b4f3b1474079980a2e5cd79ad65fb54db57"
},
{
"url": "https://git.kernel.org/stable/c/590b07ceea138d49c9b64f65d263aa902d3b4730"
},
{
"url": "https://git.kernel.org/stable/c/e36663145abd7024f0281dfb22fdef65f185845b"
},
{
"url": "https://git.kernel.org/stable/c/9f00f9cf2be293efe899db67dc5272e3a9c62717"
}
],
"title": "libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68159",
"datePublished": "2026-08-10T11:59:25.697Z",
"dateReserved": "2026-07-30T09:28:09.371Z",
"dateUpdated": "2026-10-19T20:58:55.255Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72222 (GCVE-0-2026-72222)
Vulnerability from cvelistv5
Published
2026-08-15 05:54
Modified
2026-10-16 18:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
svc_tcp_handshake() stores the raw svc_xprt pointer in
tls_handshake_args.ta_data and submits the request through
tls_server_hello_x509(). The handshake core takes only
sock_hold(req->hr_sk); nothing references the embedding struct
svc_sock that svc_tcp_handshake_done() reaches via container_of().
Two close races leave the in-flight callback writing through a freed
svc_sock. svc_sock_free() calls tls_handshake_cancel() and discards
its return value: a false return means handshake_complete() has
already set HANDSHAKE_F_REQ_COMPLETED but hp_done() may not have
finished, yet svc_sock_free() proceeds to kfree(svsk). The
cancel-loser fall-through inside svc_tcp_handshake() itself produces
the same window: when wait_for_completion_interruptible_timeout()
returns <= 0 (timeout or signal) and tls_handshake_cancel() returns
false, the function does not drain, returns, and svc_handle_xprt()
calls svc_xprt_received(), which clears XPT_BUSY and can drop the
last reference. A concurrent close then runs svc_sock_free() while
svc_tcp_handshake_done() is still updating xpt_flags and walking
svsk->sk_handshake_done.
The corruption surfaces as set_bit/clear_bit RMW into the freed
xpt_flags slab slot and as complete_all() walking and writing the
freed wait_queue_head_t list embedded in sk_handshake_done -- a
slab-corruption primitive, not a benign read. The path is reachable
on any TLS-enabled NFS server whenever a connection close overlaps
the tlshd downcall delivery window; the interruptible wait means
signal delivery suffices, not just SVC_HANDSHAKE_TO expiry.
Take svc_xprt_get(xprt) immediately before tls_server_hello_x509()
so the in-flight callback owns its own reference. Release it on the
two edges where the callback is guaranteed not to fire -- submission
failure from tls_server_hello_x509() and a successful
tls_handshake_cancel() -- and at the tail of
svc_tcp_handshake_done() after complete_all().
[cel: rewrote commit message to describe the actual change]
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72222",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:44:02.358946Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:45:02.369Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/svcsock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f3b55945dd99f29d83e1965d0141040a35262346",
"status": "affected",
"version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
"versionType": "git"
},
{
"lessThan": "2d4f97d13fff91e0bc539216be88b884b544d49f",
"status": "affected",
"version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
"versionType": "git"
},
{
"lessThan": "3f9ee75a97a769be258784c22b89657acb5ed9bd",
"status": "affected",
"version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
"versionType": "git"
},
{
"lessThan": "083e9c2ec7e8bb13b79c9fd7b337abdd758ecc5f",
"status": "affected",
"version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
"versionType": "git"
},
{
"lessThan": "4f988f3a2808fb659f3880c282041ff067acad78",
"status": "affected",
"version": "b3cbf98e2fdf3cb147a95161560cd25987284330",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/svcsock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: pin svc_xprt across the asynchronous TLS handshake callback\n\nsvc_tcp_handshake() stores the raw svc_xprt pointer in\ntls_handshake_args.ta_data and submits the request through\ntls_server_hello_x509(). The handshake core takes only\nsock_hold(req-\u003ehr_sk); nothing references the embedding struct\nsvc_sock that svc_tcp_handshake_done() reaches via container_of().\n\nTwo close races leave the in-flight callback writing through a freed\nsvc_sock. svc_sock_free() calls tls_handshake_cancel() and discards\nits return value: a false return means handshake_complete() has\nalready set HANDSHAKE_F_REQ_COMPLETED but hp_done() may not have\nfinished, yet svc_sock_free() proceeds to kfree(svsk). The\ncancel-loser fall-through inside svc_tcp_handshake() itself produces\nthe same window: when wait_for_completion_interruptible_timeout()\nreturns \u003c= 0 (timeout or signal) and tls_handshake_cancel() returns\nfalse, the function does not drain, returns, and svc_handle_xprt()\ncalls svc_xprt_received(), which clears XPT_BUSY and can drop the\nlast reference. A concurrent close then runs svc_sock_free() while\nsvc_tcp_handshake_done() is still updating xpt_flags and walking\nsvsk-\u003esk_handshake_done.\n\nThe corruption surfaces as set_bit/clear_bit RMW into the freed\nxpt_flags slab slot and as complete_all() walking and writing the\nfreed wait_queue_head_t list embedded in sk_handshake_done -- a\nslab-corruption primitive, not a benign read. The path is reachable\non any TLS-enabled NFS server whenever a connection close overlaps\nthe tlshd downcall delivery window; the interruptible wait means\nsignal delivery suffices, not just SVC_HANDSHAKE_TO expiry.\n\nTake svc_xprt_get(xprt) immediately before tls_server_hello_x509()\nso the in-flight callback owns its own reference. Release it on the\ntwo edges where the callback is guaranteed not to fire -- submission\nfailure from tls_server_hello_x509() and a successful\ntls_handshake_cancel() -- and at the tail of\nsvc_tcp_handshake_done() after complete_all().\n\n[cel: rewrote commit message to describe the actual change]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The flaw is in nfsd\u0027s server-side SUNRPC/TCP TLS handshake (net/sunrpc/svcsock.c), reached when a remote peer connects to port 2049 and sends a pre-authentication AUTH_TLS NULL STARTTLS probe that triggers svc_tcp_handshake() via svcauth_tls_accept().\nAC:L - The attacker controls both sides of the race by initiating AUTH_TLS handshakes and concurrently resetting/closing TCP or waiting for SVC_HANDSHAKE_TO while tlshd delivers completion; repeated parallel connections make the overlap window reliably reachable.\nPR:N - AUTH_TLS is processed on RPC procedure 0 before credentials are verified, so an unauthenticated remote client can reach svc_tcp_handshake() and the asynchronous callback without any account, export access, or kernel capability.\nUI:N - nfsd worker threads automatically accept the TCP connection, process the STARTTLS probe, run the TLS handshake, and handle teardown/completion callbacks without any local user or administrator action.\nS:U - Exploitation corrupts kernel memory on the NFS server host itself and does not cross a VM-guest/host, sandbox, or IOMMU security boundary; impact stays within the kernel\u0027s security authority.\nC:H - svc_tcp_handshake_done() use-after-frees svc_sock and performs set_bit/clear_bit RMW on freed xpt_flags plus complete_all() on freed sk_handshake_done, a slab-corruption UAF that can disclose arbitrary kernel memory.\nI:H - The same UAF delivers attacker-timed writes into reclaimed slab slots through atomic bit operations and wait-queue list updates, enabling heap grooming and further kernel memory corruption for arbitrary modification or code execution.\nA:H - Slab corruption and UAF during handshake completion can cause kernel oops/panic, and unauthenticated remote peers can trigger the fault repeatedly by overlapping TLS handshake completion with connection close."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:41:44.196Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f3b55945dd99f29d83e1965d0141040a35262346"
},
{
"url": "https://git.kernel.org/stable/c/2d4f97d13fff91e0bc539216be88b884b544d49f"
},
{
"url": "https://git.kernel.org/stable/c/3f9ee75a97a769be258784c22b89657acb5ed9bd"
},
{
"url": "https://git.kernel.org/stable/c/083e9c2ec7e8bb13b79c9fd7b337abdd758ecc5f"
},
{
"url": "https://git.kernel.org/stable/c/4f988f3a2808fb659f3880c282041ff067acad78"
}
],
"title": "sunrpc: pin svc_xprt across the asynchronous TLS handshake callback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72222",
"datePublished": "2026-08-15T05:54:15.277Z",
"dateReserved": "2026-08-09T03:40:39.913Z",
"dateUpdated": "2026-10-16T18:45:02.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64378 (GCVE-0-2026-64378)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
When a container exits, the following BUG_ON() is occasionally triggered:
==================================================================
VFS: Busy inodes after unmount of sdb (ext4)
------------[ cut here ]------------
kernel BUG at fs/super.c:695!
CPU: 3 PID: 6 Comm: containerd-shim Tainted: G OE K 6.6 #1
pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : generic_shutdown_super+0xf0/0x100
lr : generic_shutdown_super+0xf0/0x100
Call trace:
generic_shutdown_super+0xf0/0x100
kill_block_super+0x20/0x48
ext4_kill_sb+0x28/0x60
deactivate_locked_super+0x54/0x130
deactivate_super+0x84/0xa0
cleanup_mnt+0xa4/0x140
__cleanup_mnt+0x18/0x28
task_work_run+0x78/0xe0
do_notify_resume+0x204/0x240
==================================================================
The root cause is a race between cgroup_writeback_umount() and
inode_switch_wbs()/cleanup_offline_cgwb(). There is a window between
inode_prepare_wbs_switch() returning true and the subsequent
wb_queue_isw() call. Following is the process that triggers the issue:
CPU A (umount) | CPU B (writeback)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
inode_switch_wbs/cleanup_offline_cgwb
atomic_inc(&isw_nr_in_flight)
inode_prepare_wbs_switch
-> passes SB_ACTIVE check
__iget(inode)
generic_shutdown_super
sb->s_flags &= ~SB_ACTIVE
cgroup_writeback_umount(sb)
smp_mb()
atomic_read(&isw_nr_in_flight)
rcu_barrier()
-> no pending RCU callbacks
flush_workqueue(isw_wq)
-> nothing queued, returns
evict_inodes(sb)
-> Inode skipped as isw still holds a ref.
sop->put_super(sb)
/* destroys percpu counters */
-> VFS: Busy inodes after unmount!
wb_queue_isw()
queue_work(isw_wq, ...)
/* later in work function */
inode_switch_wbs_work_fn
process_inode_switch_wbs
iput() -> evict
percpu_counter_dec() // UAF!
Fix this by extending the RCU read-side critical section in
inode_switch_wbs() and cleanup_offline_cgwb() to cover from
inode_prepare_wbs_switch() through wb_queue_isw(). Since there is
no sleep in this window, rcu_read_lock() can be used. Then add a
synchronize_rcu() in cgroup_writeback_umount() before the existing
rcu_barrier(), so that all in-flight switchers that have passed the
SB_ACTIVE check have completed queue_work() before flush_workqueue()
is called.
The existing rcu_barrier() is intentionally retained so this fix can
be backported unchanged to stable kernels (5.10.y, 6.6.y, ...) that
still queue switches via queue_rcu_work(). It is a no-op on current
mainline (since commit e1b849cfa6b6 ("writeback: Avoid contention on
wb->list_lock when switching inodes")) and is removed in a follow-up
patch.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a1a0e23e49037c23ea84bc8cc146a03584d13577 Version: a1a0e23e49037c23ea84bc8cc146a03584d13577 Version: a1a0e23e49037c23ea84bc8cc146a03584d13577 Version: a1a0e23e49037c23ea84bc8cc146a03584d13577 Version: a1a0e23e49037c23ea84bc8cc146a03584d13577 Version: a1a0e23e49037c23ea84bc8cc146a03584d13577 Version: a1a0e23e49037c23ea84bc8cc146a03584d13577 Version: c5cbbec54fe71c4de2d34f8c0ec8fbfdd7f17339 Version: 4.4.5 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64378",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:39:41.597767Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:25.561Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/fs-writeback.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "087d5b8b501c570f84bf655164e6698c3ce146e0",
"status": "affected",
"version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
"versionType": "git"
},
{
"lessThan": "3c9c9648f77e4d14e50676bc51c2174ba9c8d361",
"status": "affected",
"version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
"versionType": "git"
},
{
"lessThan": "5c3265f3252b2ee50707adaaa3f9bd0df3df72de",
"status": "affected",
"version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
"versionType": "git"
},
{
"lessThan": "c923cc3cb5cd8945ceaf08252754110643446593",
"status": "affected",
"version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
"versionType": "git"
},
{
"lessThan": "685fc15a410885b6d4dee64de0dce721b9428b12",
"status": "affected",
"version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
"versionType": "git"
},
{
"lessThan": "53eeaf4d63068dbc7708b0c7adb20151c812feca",
"status": "affected",
"version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
"versionType": "git"
},
{
"lessThan": "cba38ec4cbd3a7b8b942a8d52531a05be8a9ff0d",
"status": "affected",
"version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
"versionType": "git"
},
{
"status": "affected",
"version": "c5cbbec54fe71c4de2d34f8c0ec8fbfdd7f17339",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/fs-writeback.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: fix race between cgroup_writeback_umount() and inode_switch_wbs()\n\nWhen a container exits, the following BUG_ON() is occasionally triggered:\n\n==================================================================\n VFS: Busy inodes after unmount of sdb (ext4)\n ------------[ cut here ]------------\n kernel BUG at fs/super.c:695!\n CPU: 3 PID: 6 Comm: containerd-shim Tainted: G OE K 6.6 #1\n pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : generic_shutdown_super+0xf0/0x100\n lr : generic_shutdown_super+0xf0/0x100\n Call trace:\n generic_shutdown_super+0xf0/0x100\n kill_block_super+0x20/0x48\n ext4_kill_sb+0x28/0x60\n deactivate_locked_super+0x54/0x130\n deactivate_super+0x84/0xa0\n cleanup_mnt+0xa4/0x140\n __cleanup_mnt+0x18/0x28\n task_work_run+0x78/0xe0\n do_notify_resume+0x204/0x240\n==================================================================\n\nThe root cause is a race between cgroup_writeback_umount() and\ninode_switch_wbs()/cleanup_offline_cgwb(). There is a window between\ninode_prepare_wbs_switch() returning true and the subsequent\nwb_queue_isw() call. Following is the process that triggers the issue:\n\n CPU A (umount) | CPU B (writeback)\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n inode_switch_wbs/cleanup_offline_cgwb\n atomic_inc(\u0026isw_nr_in_flight)\n inode_prepare_wbs_switch\n -\u003e passes SB_ACTIVE check\n __iget(inode)\n generic_shutdown_super\n sb-\u003es_flags \u0026= ~SB_ACTIVE\n cgroup_writeback_umount(sb)\n smp_mb()\n atomic_read(\u0026isw_nr_in_flight)\n rcu_barrier()\n -\u003e no pending RCU callbacks\n flush_workqueue(isw_wq)\n -\u003e nothing queued, returns\n evict_inodes(sb)\n -\u003e Inode skipped as isw still holds a ref.\n sop-\u003eput_super(sb)\n /* destroys percpu counters */\n -\u003e VFS: Busy inodes after unmount!\n wb_queue_isw()\n queue_work(isw_wq, ...)\n /* later in work function */\n inode_switch_wbs_work_fn\n process_inode_switch_wbs\n iput() -\u003e evict\n percpu_counter_dec() // UAF!\n\nFix this by extending the RCU read-side critical section in\ninode_switch_wbs() and cleanup_offline_cgwb() to cover from\ninode_prepare_wbs_switch() through wb_queue_isw(). Since there is\nno sleep in this window, rcu_read_lock() can be used. Then add a\nsynchronize_rcu() in cgroup_writeback_umount() before the existing\nrcu_barrier(), so that all in-flight switchers that have passed the\nSB_ACTIVE check have completed queue_work() before flush_workqueue()\nis called.\n\nThe existing rcu_barrier() is intentionally retained so this fix can\nbe backported unchanged to stable kernels (5.10.y, 6.6.y, ...) that\nstill queue switches via queue_rcu_work(). It is a no-op on current\nmainline (since commit e1b849cfa6b6 (\"writeback: Avoid contention on\nwb-\u003elist_lock when switching inodes\")) and is removed in a follow-up\npatch."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached through local filesystem writes, cgroup teardown, and mount-namespace or filesystem unmount paths; no network protocol directly reaches the race.\nAC:L - An attacker can churn cgroup writeback switches while repeatedly triggering container or mount teardown, controlling both racing activities and amplifying the timing window.\nPR:L - A basic local or container user can dirty writable files and initiate its own cgroup or namespace teardown; lifecycle infrastructure can perform the privileged final unmount automatically.\nUI:N - The attacker can generate the writeback state and trigger teardown without requiring another user to perform an action.\nS:U - The resulting corruption affects the same host kernel security authority and does not inherently cross a VM or hardware isolation boundary.\nC:H - The delayed worker can access superblock-private state after it and its per-CPU counters have been freed, creating an exploitable use-after-free capable of exposing arbitrary kernel memory.\nI:H - The freed superblock and per-CPU counter pointers are subsequently dereferenced and modified, potentially providing attacker-influenced kernel writes and control-flow hijacking.\nA:H - The race demonstrably triggers the busy-inode BUG_ON, and configurations continuing past that check encounter a use-after-free capable of causing an oops or kernel panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:29.511Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/087d5b8b501c570f84bf655164e6698c3ce146e0"
},
{
"url": "https://git.kernel.org/stable/c/3c9c9648f77e4d14e50676bc51c2174ba9c8d361"
},
{
"url": "https://git.kernel.org/stable/c/5c3265f3252b2ee50707adaaa3f9bd0df3df72de"
},
{
"url": "https://git.kernel.org/stable/c/c923cc3cb5cd8945ceaf08252754110643446593"
},
{
"url": "https://git.kernel.org/stable/c/685fc15a410885b6d4dee64de0dce721b9428b12"
},
{
"url": "https://git.kernel.org/stable/c/53eeaf4d63068dbc7708b0c7adb20151c812feca"
},
{
"url": "https://git.kernel.org/stable/c/cba38ec4cbd3a7b8b942a8d52531a05be8a9ff0d"
}
],
"title": "writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64378",
"datePublished": "2026-07-25T08:50:29.006Z",
"dateReserved": "2026-07-19T15:36:31.784Z",
"dateUpdated": "2026-10-19T20:38:25.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43051 (GCVE-0-2026-43051)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-10-19 19:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
The wacom_intuos_bt_irq() function processes Bluetooth HID reports
without sufficient bounds checking. A maliciously crafted short report
can trigger an out-of-bounds read when copying data into the wacom
structure.
Specifically, report 0x03 requires at least 22 bytes to safely read
the processed data and battery status, while report 0x04 (which
falls through to 0x03) requires 32 bytes.
Add explicit length checks for these report IDs and log a warning if
a short report is received.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a Version: 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a Version: 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a Version: 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a Version: 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a Version: 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a Version: 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a Version: 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43051",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:14:00.224091Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:06:11.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/wacom_wac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada",
"status": "affected",
"version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a",
"versionType": "git"
},
{
"lessThan": "5b5b9730111808410e404ceac2fabd32eef92fbd",
"status": "affected",
"version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a",
"versionType": "git"
},
{
"lessThan": "fa8901cb1f0b2113a342db93bd5684b59fe99dcf",
"status": "affected",
"version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a",
"versionType": "git"
},
{
"lessThan": "8bd690ac1242332c73cba10dacdad6c6642bbb94",
"status": "affected",
"version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a",
"versionType": "git"
},
{
"lessThan": "41026bcc0fdf82605205c27935ef719cbc07193b",
"status": "affected",
"version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a",
"versionType": "git"
},
{
"lessThan": "c8dc23c97680eebefde06da5858aaef1b37cf75d",
"status": "affected",
"version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a",
"versionType": "git"
},
{
"lessThan": "3d78386b144453c47e81bf62dc3601b757f02d99",
"status": "affected",
"version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a",
"versionType": "git"
},
{
"lessThan": "2f1763f62909ccb6386ac50350fa0abbf5bb16a9",
"status": "affected",
"version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/wacom_wac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq\n\nThe wacom_intuos_bt_irq() function processes Bluetooth HID reports\nwithout sufficient bounds checking. A maliciously crafted short report\ncan trigger an out-of-bounds read when copying data into the wacom\nstructure.\n\nSpecifically, report 0x03 requires at least 22 bytes to safely read\nthe processed data and battery status, while report 0x04 (which\nfalls through to 0x03) requires 32 bytes.\n\nAdd explicit length checks for these report IDs and log a warning if\na short report is received."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable handler processes Bluetooth HID input reports from Wacom Intuos wireless devices, so an attacker must be within Bluetooth radio range or control a Bluetooth HID peripheral.\nAC:L - The attacker directly controls the report ID and report length; a short 0x03 or 0x04 report deterministically reaches the missing bounds checks once the HIDP session exists.\nPR:N - The attacker is the Bluetooth HID peer sending input reports and needs no local kernel privileges. The local HIDP setup path uses CAP_NET_ADMIN, but that is a host-side management gate, not a privilege required by the remote reporting device.\nUI:N - No victim action is needed to trigger the bug after the malicious or compromised Bluetooth HID device is connected; it can send the crafted input report on its own.\nS:U - The vulnerable Wacom HID driver and the impacted kernel/input state are under the same host kernel security authority.\nC:H - The bug reads beyond a kmemdup() report buffer and copies adjacent kernel heap bytes into Wacom report processing state. Because this is a kernel heap out-of-bounds read of up to the 32-byte report window, high confidentiality impact is the highest defensible assessment.\nI:N - The defect is an out-of-bounds read, not an out-of-bounds write or use-after-free, and it does not provide an attacker-controlled kernel memory modification primitive.\nA:H - Malformed short reports can repeatedly trigger kernel out-of-bounds reads; on hardened/debug configurations this is a KASAN-detected kernel fault, and on production systems it is defensible to treat repeated invalid kernel memory access as a potential crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:34.976Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada"
},
{
"url": "https://git.kernel.org/stable/c/5b5b9730111808410e404ceac2fabd32eef92fbd"
},
{
"url": "https://git.kernel.org/stable/c/fa8901cb1f0b2113a342db93bd5684b59fe99dcf"
},
{
"url": "https://git.kernel.org/stable/c/8bd690ac1242332c73cba10dacdad6c6642bbb94"
},
{
"url": "https://git.kernel.org/stable/c/41026bcc0fdf82605205c27935ef719cbc07193b"
},
{
"url": "https://git.kernel.org/stable/c/c8dc23c97680eebefde06da5858aaef1b37cf75d"
},
{
"url": "https://git.kernel.org/stable/c/3d78386b144453c47e81bf62dc3601b757f02d99"
},
{
"url": "https://git.kernel.org/stable/c/2f1763f62909ccb6386ac50350fa0abbf5bb16a9"
}
],
"title": "HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43051",
"datePublished": "2026-05-01T14:15:45.314Z",
"dateReserved": "2026-05-01T14:12:55.980Z",
"dateUpdated": "2026-10-19T19:06:11.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98432 (GCVE-0-2026-98432)
Vulnerability from cvelistv5
Published
2026-10-15 12:08
Modified
2026-11-03 06:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: free inet_opt and ireq_opt after an RCU grace period
tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the
child socket (newinet->inet_opt) without copying it.
Another cpu can concurrently process a retransmitted SYN for the same
request socket, and send a SYNACK from tcp_check_req().
tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt
under rcu_read_lock() only, and ip_build_and_send_pkt() and
ip_options_build() then read opt->optlen twice.
Note that the SYNACK timer itself is not an issue: it holds a
reference on its request socket, and inet_csk_reqsk_queue_drop()
calls timer_delete_sync() before the child can be freed.
Since commit 079096f103fa ("tcp/dccp: install syn_recv requests
into ehash table"), request sockets are processed without holding
the listener lock, so nothing prevents the child socket from being
freed while the SYNACK is still being built. TCP child sockets do
not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt
with a plain kfree(), leading to a use-after-free in
ip_options_build().
A similar issue exists with request socket migration
(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE
program). reqsk_timer_handler() clones the request socket with
inet_reqsk_clone(), so that the old request socket and its clone
share the same ireq_opt, then reqsk_migrate_reset() clears the
pointer in the old one. Another cpu holding a reference on the old
request socket can still be using these options (sending a SYNACK,
or creating a child in tcp_v4_syn_recv_sock()) when the clone is
freed, and tcp_v4_reqsk_destructor() also uses a plain kfree().
Readers already use RCU, and other paths replacing inet_opt
(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use
kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and
tcp_v4_reqsk_destructor() as well.
IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()
duplicates the options. tcp_v6_reqsk_destructor() has the same
migration issue with ipv6_opt, which is only set by CALIPSO. This
will be addressed in a separate patch.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 079096f103faca2dd87342cca6f23d4b34da8871 Version: 079096f103faca2dd87342cca6f23d4b34da8871 Version: 079096f103faca2dd87342cca6f23d4b34da8871 Version: 079096f103faca2dd87342cca6f23d4b34da8871 Version: 079096f103faca2dd87342cca6f23d4b34da8871 Version: 079096f103faca2dd87342cca6f23d4b34da8871 Version: 079096f103faca2dd87342cca6f23d4b34da8871 Version: 079096f103faca2dd87342cca6f23d4b34da8871 |
||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-11-03T06:08:32.425Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/30/1"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/30/6"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/31/5"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/11/03/1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/af_inet.c",
"net/ipv4/tcp_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b3b027ef0cd322bfa839b9aaf5b27551eea54cf6",
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"versionType": "git"
},
{
"lessThan": "95a8c8fa9f27dce64c40c41c062de7728bf34ab5",
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"versionType": "git"
},
{
"lessThan": "89b5b1eb7d633c33832b7ff2c02e19a144705036",
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"versionType": "git"
},
{
"lessThan": "742f73df544e03744f2981c467d6542fe8172a2a",
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"versionType": "git"
},
{
"lessThan": "11a03ce3c4a62d84c10ccdfe47f8075006498568",
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"versionType": "git"
},
{
"lessThan": "a47406c769f72c070386985488f1c4d057df86b2",
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"versionType": "git"
},
{
"lessThan": "26d4c36d318cffbbd160884a0e4cec0da4da4936",
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"versionType": "git"
},
{
"lessThan": "e3f33b0a1d89d738e2b913dab519226eaf76e15b",
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/af_inet.c",
"net/ipv4/tcp_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.272",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.223",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.190",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.159",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.272",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.223",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.190",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.159",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free inet_opt and ireq_opt after an RCU grace period\n\ntcp_v4_syn_recv_sock() transfers ownership of ireq-\u003eireq_opt to the\nchild socket (newinet-\u003einet_opt) without copying it.\n\nAnother cpu can concurrently process a retransmitted SYN for the same\nrequest socket, and send a SYNACK from tcp_check_req().\ntcp_v4_send_synack() and inet_csk_route_req() read ireq-\u003eireq_opt\nunder rcu_read_lock() only, and ip_build_and_send_pkt() and\nip_options_build() then read opt-\u003eoptlen twice.\n\nNote that the SYNACK timer itself is not an issue: it holds a\nreference on its request socket, and inet_csk_reqsk_queue_drop()\ncalls timer_delete_sync() before the child can be freed.\n\nSince commit 079096f103fa (\"tcp/dccp: install syn_recv requests\ninto ehash table\"), request sockets are processed without holding\nthe listener lock, so nothing prevents the child socket from being\nfreed while the SYNACK is still being built. TCP child sockets do\nnot have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt\nwith a plain kfree(), leading to a use-after-free in\nip_options_build().\n\nA similar issue exists with request socket migration\n(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE\nprogram). reqsk_timer_handler() clones the request socket with\ninet_reqsk_clone(), so that the old request socket and its clone\nshare the same ireq_opt, then reqsk_migrate_reset() clears the\npointer in the old one. Another cpu holding a reference on the old\nrequest socket can still be using these options (sending a SYNACK,\nor creating a child in tcp_v4_syn_recv_sock()) when the clone is\nfreed, and tcp_v4_reqsk_destructor() also uses a plain kfree().\n\nReaders already use RCU, and other paths replacing inet_opt\n(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use\nkfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and\ntcp_v4_reqsk_destructor() as well.\n\nIPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()\nduplicates the options. tcp_v6_reqsk_destructor() has the same\nmigration issue with ipv6_opt, which is only set by CALIPSO. This\nwill be addressed in a separate patch."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - An unauthenticated peer supplies IPv4 Record Route or Timestamp bytes in a TCP SYN; ip_rcv_options() and tcp_v4_save_options() store them in ireq_opt. Its retransmitted SYN follows tcp_v4_rcv()-\u003etcp_check_req()-\u003etcp_rtx_synack()-\u003etcp_v4_send_synack(), racing frees in patched inet_sock_destruct() or tcp_v4_reqsk_destructor().\nAC:L - On an accepting server, the peer can repeatedly create an option-bearing request and race a retransmitted SYN against completing and tearing down that same TCP connection. Both racing sides are attacker-induced; multicore scheduling and heap grooming do not constitute conditions outside the attacker\u0027s influence.\nPR:N - tcp_v4_rcv() reaches tcp_check_req() and tcp_v4_send_synack() during the TCP handshake, before application authentication. The target performs no capability or credential check on the peer\u0027s valid IPv4 Record Route or Timestamp option.\nUI:N - The peer sends the option-bearing SYN, retransmitted SYN, and handshake or teardown packets to an already listening service; no victim user must mount, open, or approve anything.\nS:U - The stale ip_options_rcu object is consumed and corrupts memory within the same host kernel in ip_build_and_send_pkt() and ip_options_build(); no separate security authority is crossed.\nC:H - After inet_sock_destruct() frees inet_opt, ip_options_build() copies opt-\u003e__data for the stale opt-\u003eoptlen into the network-bound SYNACK. Reclaiming the object can therefore disclose adjacent kernel heap contents directly to the peer.\nI:H - Reclaiming the freed ip_options_rcu lets stale optlen and srr, rr, or ts offsets steer ip_options_build() memcpy and address or timestamp writes, permitting out-of-bounds kernel writes and potential control-flow corruption.\nA:H - A reclaimed optlen can make ip_build_and_send_pkt() call skb_push() beyond the SYNACK headroom, invoking skb_under_panic(); the stale-offset writes in ip_options_build() can also oops the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:08:46.326Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6"
},
{
"url": "https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5"
},
{
"url": "https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036"
},
{
"url": "https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a"
},
{
"url": "https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568"
},
{
"url": "https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2"
},
{
"url": "https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936"
},
{
"url": "https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b"
}
],
"title": "ipv4: free inet_opt and ireq_opt after an RCU grace period",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98432",
"datePublished": "2026-10-15T12:08:22.205Z",
"dateReserved": "2026-09-25T10:25:14.348Z",
"dateUpdated": "2026-11-03T06:08:32.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74588 (GCVE-0-2026-74588)
Vulnerability from cvelistv5
Published
2026-08-22 15:31
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: keep chunk->transport in step with the list it is queued on
__sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's
transmitted list without updating chunk->transport:
if (chunk->tsn_gap_acked) {
list_move_tail(&chunk->transmitted_list,
&transport->transmitted);
continue;
}
The chunk then sits on a live transport's list while chunk->transport still
names a different one. If that transport is removed - sctp_assoc_rm_peer()
from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk
is left with a dangling pointer. sctp_assoc_rm_peer() scrubs
peer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on
neither.
The pointer is not followed while tsn_gap_acked is set. A SACK that
reneges on the TSN clears the flag, and the next SACK reaches
tchunk->transport->flight_size -= sctp_data_size(tchunk);
inside the freed transport. KASAN reports a slab-use-after-free read in
sctp_check_transmitted(), freed from sctp_assoc_rm_peer(). Both the
removal and the SACKs come from the association peer.
Set chunk->transport at the move. The ordinary resend path needs nothing:
it reaches its list_move_tail() only after sctp_packet_append_chunk()
returned SCTP_XMIT_OK, and __sctp_packet_append_chunk() has rebound the
chunk by then.
Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74588",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:01:29.030905Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:59.010Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/outqueue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6575fb17230814b48b471727c8410c0aadff9274",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6b9e2ea2057113f3393990ba646d2d97c719a80d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "874a7c2b5e184f06134fdfde27e9ce9271bafe58",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1adf929121e13e0b19200bb9fef715b918d483fe",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e2e7c1de0e226ca1b7fea2de57a6c9bca408709b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9f2cf069a9a72a2d6b97ca8b4c70e714aac99749",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/outqueue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: keep chunk-\u003etransport in step with the list it is queued on\n\n__sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport\u0027s\ntransmitted list without updating chunk-\u003etransport:\n\n\tif (chunk-\u003etsn_gap_acked) {\n\t\tlist_move_tail(\u0026chunk-\u003etransmitted_list,\n\t\t\t \u0026transport-\u003etransmitted);\n\t\tcontinue;\n\t}\n\nThe chunk then sits on a live transport\u0027s list while chunk-\u003etransport still\nnames a different one. If that transport is removed - sctp_assoc_rm_peer()\nfrom an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk\nis left with a dangling pointer. sctp_assoc_rm_peer() scrubs\npeer-\u003etransmitted and asoc-\u003eoutqueue.out_chunk_list, but the chunk is on\nneither.\n\nThe pointer is not followed while tsn_gap_acked is set. A SACK that\nreneges on the TSN clears the flag, and the next SACK reaches\n\n\ttchunk-\u003etransport-\u003eflight_size -= sctp_data_size(tchunk);\n\ninside the freed transport. KASAN reports a slab-use-after-free read in\nsctp_check_transmitted(), freed from sctp_assoc_rm_peer(). Both the\nremoval and the SACKs come from the association peer.\n\nSet chunk-\u003etransport at the move. The ordinary resend path needs nothing:\nit reaches its list_move_tail() only after sctp_packet_append_chunk()\nreturned SCTP_XMIT_OK, and __sctp_packet_append_chunk() has rebound the\nchunk by then.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached when the kernel SCTP stack processes inbound SACK and ASCONF chunks from a remote association peer via sctp_rcv()/sctp_inq_push(), with no local syscall or ioctl required on the victim.\nAC:L - The remote peer controls the SCTP protocol sequence (gap SACKs, ADDIP multihoming, ASCONF Delete-IP, and SACK reneging) needed to strand a chunk and free its transport; no attacker-uncontrollable race or rare memory layout is required.\nPR:N - Exploitation requires only network access as an established SCTP association peer sending authenticated protocol traffic; no local Linux account, capability, or namespace privilege is needed on the victim host.\nUI:N - No victim user action is required beyond normal automated SCTP server/client operation; the attacker drives the entire trigger sequence with crafted SACK and ASCONF packets on the existing association.\nS:U - Impact is confined to kernel memory corruption and potential privilege escalation within the host kernel; it does not cross a VM, container, or IOMMU security boundary.\nC:H - KASAN reports a slab use-after-free read through dangling chunk-\u003etransport in sctp_check_transmitted(); UAF on sctp_transport objects can be groomed for arbitrary kernel memory disclosure.\nI:H - The UAF dereference performs flight_size arithmetic on a freed sctp_transport slab object, enabling heap grooming and arbitrary kernel write or control-flow hijack primitives typical of SCTP transport UAFs.\nA:H - Accessing freed transport memory during SACK processing can cause kernel oops/panic and repeatable remote denial of service against any SCTP endpoint handling the malicious peer traffic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:15.097Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6575fb17230814b48b471727c8410c0aadff9274"
},
{
"url": "https://git.kernel.org/stable/c/6b9e2ea2057113f3393990ba646d2d97c719a80d"
},
{
"url": "https://git.kernel.org/stable/c/874a7c2b5e184f06134fdfde27e9ce9271bafe58"
},
{
"url": "https://git.kernel.org/stable/c/1adf929121e13e0b19200bb9fef715b918d483fe"
},
{
"url": "https://git.kernel.org/stable/c/e2e7c1de0e226ca1b7fea2de57a6c9bca408709b"
},
{
"url": "https://git.kernel.org/stable/c/2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d"
},
{
"url": "https://git.kernel.org/stable/c/5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b"
},
{
"url": "https://git.kernel.org/stable/c/9f2cf069a9a72a2d6b97ca8b4c70e714aac99749"
}
],
"title": "sctp: keep chunk-\u003etransport in step with the list it is queued on",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74588",
"datePublished": "2026-08-22T15:31:40.466Z",
"dateReserved": "2026-08-15T05:44:03.918Z",
"dateUpdated": "2026-10-16T19:05:59.010Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68162 (GCVE-0-2026-68162)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: avoid auth_enable sysctl UAF during netns teardown
proc_sctp_do_auth() updates the SCTP control socket after changing
net.sctp.auth_enable. The handler gets the per-net SCTP state from
ctl->data, so an already opened sysctl file can still target a network
namespace while that namespace is being torn down.
SCTP previously registered its per-net sysctls from sctp_defaults_init(),
while the control socket is created later from sctp_ctrlsock_init(). This
exposed a window during initialization where auth_enable was writable
before net->sctp.ctl_sock existed, and a teardown window where auth_enable
stayed writable after inet_ctl_sock_destroy() had released the control
socket.
Move the per-net SCTP sysctl registration into sctp_ctrlsock_init() after
sctp_ctl_sock_init() succeeds, and unregister the sysctl table before
destroying the control socket in sctp_ctrlsock_exit(). If sysctl
registration fails after the control socket was created, destroy the
control socket in the same init path.
Make sctp_sysctl_net_unregister() tolerate a missing header and clear the
saved pointer so init-error and exit paths can safely share the unregister
helper.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 10c869a52f266e40f548cc3c565d14930a5edafc Version: dc583e7e5f8515ca489c0df28e4362a70eade382 Version: bd2a2939423566c654545fa3e96a656662a0af9e Version: 1b67030d39f2b00f94ac1f0af11ba6657589e4d3 Version: 7ec30c54f339c640aa7e49d7e9f7bbed6bd42bf6 Version: c184bc621e3cef03ac9ba81a50dda2dae6a21d36 Version: 15649fd5415eda664ef35780c2013adeb5d9c695 Version: 15649fd5415eda664ef35780c2013adeb5d9c695 Version: 15649fd5415eda664ef35780c2013adeb5d9c695 Version: 5.4.290 ≤ Version: 5.10.234 ≤ Version: 5.15.177 ≤ Version: 6.1.125 ≤ Version: 6.6.72 ≤ Version: 6.12.10 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68162",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:45:25.940723Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:55.689Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/protocol.c",
"net/sctp/sysctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "19573dcddb8819fd68d6cd1f916c1c99c3fa4ff4",
"status": "affected",
"version": "10c869a52f266e40f548cc3c565d14930a5edafc",
"versionType": "git"
},
{
"lessThan": "ceb7190b5c873d4a1267a1600c5aa52c600e929f",
"status": "affected",
"version": "dc583e7e5f8515ca489c0df28e4362a70eade382",
"versionType": "git"
},
{
"lessThan": "fd66854a22661929245f3d2b244c432bc8b1a150",
"status": "affected",
"version": "bd2a2939423566c654545fa3e96a656662a0af9e",
"versionType": "git"
},
{
"lessThan": "158f3cc332dc53f43ec20060233d7c3cecd6d912",
"status": "affected",
"version": "1b67030d39f2b00f94ac1f0af11ba6657589e4d3",
"versionType": "git"
},
{
"lessThan": "66700c0719675e0e118ae83b2d7168dacd69dd3d",
"status": "affected",
"version": "7ec30c54f339c640aa7e49d7e9f7bbed6bd42bf6",
"versionType": "git"
},
{
"lessThan": "626bda8cfe43dff19a9833ff6ba055a817b5455c",
"status": "affected",
"version": "c184bc621e3cef03ac9ba81a50dda2dae6a21d36",
"versionType": "git"
},
{
"lessThan": "be6aae9d1b91c603adb35872d37d40e83daf8758",
"status": "affected",
"version": "15649fd5415eda664ef35780c2013adeb5d9c695",
"versionType": "git"
},
{
"lessThan": "a50e73488e0bbdd262b3be3c9a1d8dd078382381",
"status": "affected",
"version": "15649fd5415eda664ef35780c2013adeb5d9c695",
"versionType": "git"
},
{
"lessThan": "f8d5e7846025f4ab15a461235f8ebae9094a361a",
"status": "affected",
"version": "15649fd5415eda664ef35780c2013adeb5d9c695",
"versionType": "git"
},
{
"lessThan": "5.4.292",
"status": "affected",
"version": "5.4.290",
"versionType": "semver"
},
{
"lessThan": "5.10.266",
"status": "affected",
"version": "5.10.234",
"versionType": "semver"
},
{
"lessThan": "5.15.217",
"status": "affected",
"version": "5.15.177",
"versionType": "semver"
},
{
"lessThan": "6.1.184",
"status": "affected",
"version": "6.1.125",
"versionType": "semver"
},
{
"lessThan": "6.6.151",
"status": "affected",
"version": "6.6.72",
"versionType": "semver"
},
{
"lessThan": "6.12.101",
"status": "affected",
"version": "6.12.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/protocol.c",
"net/sctp/sysctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.292",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.292",
"versionStartIncluding": "5.4.290",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "5.10.234",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.15.177",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "6.1.125",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "6.6.72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.12.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid auth_enable sysctl UAF during netns teardown\n\nproc_sctp_do_auth() updates the SCTP control socket after changing\nnet.sctp.auth_enable. The handler gets the per-net SCTP state from\nctl-\u003edata, so an already opened sysctl file can still target a network\nnamespace while that namespace is being torn down.\n\nSCTP previously registered its per-net sysctls from sctp_defaults_init(),\nwhile the control socket is created later from sctp_ctrlsock_init(). This\nexposed a window during initialization where auth_enable was writable\nbefore net-\u003esctp.ctl_sock existed, and a teardown window where auth_enable\nstayed writable after inet_ctl_sock_destroy() had released the control\nsocket.\n\nMove the per-net SCTP sysctl registration into sctp_ctrlsock_init() after\nsctp_ctl_sock_init() succeeds, and unregister the sysctl table before\ndestroying the control socket in sctp_ctrlsock_exit(). If sysctl\nregistration fails after the control socket was created, destroy the\ncontrol socket in the same init path.\n\nMake sctp_sysctl_net_unregister() tolerate a missing header and clear the\nsaved pointer so init-error and exit paths can safely share the unregister\nhelper."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is triggered only by writing the per-net sysctl net.sctp.auth_enable via /proc/sys (proc_sctp_do_auth); it is not reachable from SCTP packet receive, sockets, or other remote protocol paths.\nAC:L - An attacker can open the sysctl file, concurrently destroy the target network namespace, and repeatedly write during teardown; pernet exit destroys ctl_sock before unregistering sysctls, and the attacker controls both sides of that race.\nPR:L - Exploitation requires writing a mode 0644 sysctl in a network namespace; an unprivileged host user with CAP_NET_ADMIN via user namespaces can create a netns, become namespace root, and write net/sctp/auth_enable without init-namespace privileges.\nUI:N - No victim interaction is required beyond the attacker opening the sysctl and triggering namespace teardown in their own threads or processes.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same host/kernel security domain; it does not cross VM, container, or IOMMU boundaries by itself.\nC:H - proc_sctp_do_auth dereferences net-\u003esctp.ctl_sock after inet_ctl_sock_destroy; lock_sock and sctp_sk(sk)-\u003eep access freed socket/endpoint memory, a use-after-free that can disclose or infer heap contents.\nI:H - On a successful write, the handler sets sctp_sk(sk)-\u003eep-\u003eauth_enable on a freed endpoint object, giving a controlled heap write primitive that can be developed into arbitrary kernel modification or code execution.\nA:H - Use-after-free on the SCTP control socket/endpoint during sysctl processing can cause kernel oops/panic from lock_sock or ep access on freed memory, even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:46:01.222Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/19573dcddb8819fd68d6cd1f916c1c99c3fa4ff4"
},
{
"url": "https://git.kernel.org/stable/c/ceb7190b5c873d4a1267a1600c5aa52c600e929f"
},
{
"url": "https://git.kernel.org/stable/c/fd66854a22661929245f3d2b244c432bc8b1a150"
},
{
"url": "https://git.kernel.org/stable/c/158f3cc332dc53f43ec20060233d7c3cecd6d912"
},
{
"url": "https://git.kernel.org/stable/c/66700c0719675e0e118ae83b2d7168dacd69dd3d"
},
{
"url": "https://git.kernel.org/stable/c/626bda8cfe43dff19a9833ff6ba055a817b5455c"
},
{
"url": "https://git.kernel.org/stable/c/be6aae9d1b91c603adb35872d37d40e83daf8758"
},
{
"url": "https://git.kernel.org/stable/c/a50e73488e0bbdd262b3be3c9a1d8dd078382381"
},
{
"url": "https://git.kernel.org/stable/c/f8d5e7846025f4ab15a461235f8ebae9094a361a"
}
],
"title": "sctp: avoid auth_enable sysctl UAF during netns teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68162",
"datePublished": "2026-08-10T11:59:29.099Z",
"dateReserved": "2026-07-30T09:28:09.372Z",
"dateUpdated": "2026-10-19T20:58:55.689Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68156 (GCVE-0-2026-68156)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: refresh auth->authorizer_buf{,_len} after authorizer update
ceph_x_create_authorizer() caches au->buf->vec.iov_base and
au->buf->vec.iov_len in struct ceph_auth_handshake. These
cached values are then used by the messenger connect code when
sending the authorizer.
ceph_x_update_authorizer() can rebuild the authorizer when a newer
service ticket is available. If the rebuilt authorizer no longer
fits in the existing buffer, ceph_x_build_authorizer() drops its
reference to au->buf and allocates a new one. If this is the final
reference, ceph_buffer_put() frees the old ceph_buffer and its
vec.iov_base, but auth->authorizer_buf still points at that freed
memory.
A subsequent msgr1 reconnect can therefore queue the stale pointer
and trigger a KASAN slab-use-after-free in _copy_from_iter() while
tcp_sendmsg() copies the authorizer.
Refresh auth->authorizer_buf and auth->authorizer_buf_len after a
successful authorizer rebuild so the messenger sends the current
buffer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0bed9b5c523d577378b6f83eab5835fe30c27208 Version: 0bed9b5c523d577378b6f83eab5835fe30c27208 Version: 0bed9b5c523d577378b6f83eab5835fe30c27208 Version: 0bed9b5c523d577378b6f83eab5835fe30c27208 Version: 0bed9b5c523d577378b6f83eab5835fe30c27208 Version: 0bed9b5c523d577378b6f83eab5835fe30c27208 Version: 0bed9b5c523d577378b6f83eab5835fe30c27208 Version: 0bed9b5c523d577378b6f83eab5835fe30c27208 Version: 29c65a277a64645af853e8c9a9b3dda0ddc421e0 Version: d2c7223497cf8228416c70e3f4238ddd6c5bdf3c Version: 3.4.50 ≤ Version: 3.9.7 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68156",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:45:09.780823Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:54.796Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/auth_x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2334e9997308305ee4fd508fdfe6086c4150ed60",
"status": "affected",
"version": "0bed9b5c523d577378b6f83eab5835fe30c27208",
"versionType": "git"
},
{
"lessThan": "79a273df64238a4ade8b709689a78589f755b8ef",
"status": "affected",
"version": "0bed9b5c523d577378b6f83eab5835fe30c27208",
"versionType": "git"
},
{
"lessThan": "26f814187abceee90dbb29a02133adb4786fbb13",
"status": "affected",
"version": "0bed9b5c523d577378b6f83eab5835fe30c27208",
"versionType": "git"
},
{
"lessThan": "9d37aec9ffe4e743dabc3f84502e9723e17a30d4",
"status": "affected",
"version": "0bed9b5c523d577378b6f83eab5835fe30c27208",
"versionType": "git"
},
{
"lessThan": "75e82e8944ac1efe9fdb88bd2f14d9a031282bdf",
"status": "affected",
"version": "0bed9b5c523d577378b6f83eab5835fe30c27208",
"versionType": "git"
},
{
"lessThan": "0060ec912292a550198d8d18ac95b433c92a7091",
"status": "affected",
"version": "0bed9b5c523d577378b6f83eab5835fe30c27208",
"versionType": "git"
},
{
"lessThan": "5ecfcd5c05866f185357700b81b461dae4f5ebb2",
"status": "affected",
"version": "0bed9b5c523d577378b6f83eab5835fe30c27208",
"versionType": "git"
},
{
"lessThan": "937d61f86d377a3aa578adae7a3dfcecdddf9d89",
"status": "affected",
"version": "0bed9b5c523d577378b6f83eab5835fe30c27208",
"versionType": "git"
},
{
"status": "affected",
"version": "29c65a277a64645af853e8c9a9b3dda0ddc421e0",
"versionType": "git"
},
{
"status": "affected",
"version": "d2c7223497cf8228416c70e3f4238ddd6c5bdf3c",
"versionType": "git"
},
{
"lessThan": "3.5",
"status": "affected",
"version": "3.4.50",
"versionType": "semver"
},
{
"lessThan": "3.10",
"status": "affected",
"version": "3.9.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/auth_x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.4.50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.9.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update\n\nceph_x_create_authorizer() caches au-\u003ebuf-\u003evec.iov_base and\nau-\u003ebuf-\u003evec.iov_len in struct ceph_auth_handshake. These\ncached values are then used by the messenger connect code when\nsending the authorizer.\n\nceph_x_update_authorizer() can rebuild the authorizer when a newer\nservice ticket is available. If the rebuilt authorizer no longer\nfits in the existing buffer, ceph_x_build_authorizer() drops its\nreference to au-\u003ebuf and allocates a new one. If this is the final\nreference, ceph_buffer_put() frees the old ceph_buffer and its\nvec.iov_base, but auth-\u003eauthorizer_buf still points at that freed\nmemory.\n\nA subsequent msgr1 reconnect can therefore queue the stale pointer\nand trigger a KASAN slab-use-after-free in _copy_from_iter() while\ntcp_sendmsg() copies the authorizer.\n\nRefresh auth-\u003eauthorizer_buf and auth-\u003eauthorizer_buf_len after a\nsuccessful authorizer rebuild so the messenger sends the current\nbuffer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A compromised or malicious Ceph monitor/OSD delivers rotated cephx service tickets over TCP that increase secret_id and can enlarge the authorizer; on subsequent msgr1 reconnect the stale authorizer_buf is copied in tcp_sendmsg, so the UAF is reachable from the network peer without local syscall access.\nAC:L - An attacker controlling the Ceph cluster can deterministically issue a larger rotated ticket to force ceph_buffer realloc in ceph_x_update_authorizer, then trigger an msgr1 OSD/MDS/MON reconnect; no victim-specific memory layout or uncontrollable race is required.\nPR:N - Exploitation requires no privileges on the victim host; any kernel Ceph/RBD/CephFS client already connected to an attacker-controlled or compromised cluster is sufficient, matching other libceph client CVEs where the remote peer drives the bug.\nUI:N - After initial Ceph client setup, service-ticket rotation and messenger reconnects occur automatically; no further interactive user action is needed to reach the stale-buffer send path.\nS:U - The slab UAF corrupts kernel heap memory on the Ceph client host for local privilege escalation or crash, but does not cross VM, IOMMU, or container sandbox boundaries to another security authority.\nC:H - KASAN-confirmed slab use-after-free in _copy_from_iter during authorizer transmission reads freed kmalloc memory, which can disclose adjacent kernel pointers and is classed as exploitable arbitrary read per kernel UAF guidance.\nI:H - Freed authorizer buffers can be reclaimed with attacker-controlled data before reconnect, enabling heap corruption and control-flow hijack during the stale-pointer copy, consistent with kernel UAF write primitive scoring.\nA:H - The reported KASAN slab-use-after-free in tcp_sendmsg while copying the authorizer reliably causes kernel oops or panic on Ceph client reconnect, and remains repeatable whenever tickets are rotated and msgr1 reconnects."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:30:25.089Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2334e9997308305ee4fd508fdfe6086c4150ed60"
},
{
"url": "https://git.kernel.org/stable/c/79a273df64238a4ade8b709689a78589f755b8ef"
},
{
"url": "https://git.kernel.org/stable/c/26f814187abceee90dbb29a02133adb4786fbb13"
},
{
"url": "https://git.kernel.org/stable/c/9d37aec9ffe4e743dabc3f84502e9723e17a30d4"
},
{
"url": "https://git.kernel.org/stable/c/75e82e8944ac1efe9fdb88bd2f14d9a031282bdf"
},
{
"url": "https://git.kernel.org/stable/c/0060ec912292a550198d8d18ac95b433c92a7091"
},
{
"url": "https://git.kernel.org/stable/c/5ecfcd5c05866f185357700b81b461dae4f5ebb2"
},
{
"url": "https://git.kernel.org/stable/c/937d61f86d377a3aa578adae7a3dfcecdddf9d89"
}
],
"title": "libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68156",
"datePublished": "2026-08-10T11:59:22.514Z",
"dateReserved": "2026-07-30T09:28:09.371Z",
"dateUpdated": "2026-10-19T20:58:54.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53224 (GCVE-0-2026-53224)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-10-30 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate embedded INIT chunk and address list lengths in cookie
sctp_unpack_cookie() only checked that the embedded INIT chunk length
did not exceed the remaining cookie payload, but did not ensure that the
INIT chunk is large enough to contain a complete INIT header.
A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose
length field is smaller than sizeof(struct sctp_init_chunk). Later,
sctp_process_init() accesses INIT parameters unconditionally, which may
lead to out-of-bounds reads.
In addition, raw_addr_list_len is not fully validated against the
remaining cookie payload. When cookie authentication is disabled, an
attacker can supply an oversized raw_addr_list_len and cause
sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The
address parser also lacks sufficient bounds checks for parameter headers
and lengths, allowing malformed address parameters to trigger
out-of-bounds reads.
Fix this by:
- requiring the embedded INIT chunk length to be at least sizeof(struct
sctp_init_chunk);
- validating that the INIT chunk and raw address list together fit
within the cookie payload;
- verifying sufficient data exists for each address parameter header and
payload before parsing it.
Note that sctp_verify_init() must be called after sctp_unpack_cookie()
and before sctp_process_init() when cookie authentication is disabled.
This will be addressed in a separate patch.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53224",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:27:11.473307Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:57:29.827Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/bind_addr.c",
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b1ca7dcfb335caa2c73d2d1bb5710e6dea2c11e0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "dd75066882ecc4ec8df3f5384b4b9fa9579be8f0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "29ab56e7660b6f849c10c46e87e085649df751eb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7560afb8cddafd829e709d7ea09230e45a825557",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "512a9bb77c04ac9927648ea58af617e472be96e6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6f4c80a2a7e6d06753b89a578b710a2499a5e62b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/bind_addr.c",
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate embedded INIT chunk and address list lengths in cookie\n\nsctp_unpack_cookie() only checked that the embedded INIT chunk length\ndid not exceed the remaining cookie payload, but did not ensure that the\nINIT chunk is large enough to contain a complete INIT header.\n\nA malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose\nlength field is smaller than sizeof(struct sctp_init_chunk). Later,\nsctp_process_init() accesses INIT parameters unconditionally, which may\nlead to out-of-bounds reads.\n\nIn addition, raw_addr_list_len is not fully validated against the\nremaining cookie payload. When cookie authentication is disabled, an\nattacker can supply an oversized raw_addr_list_len and cause\nsctp_raw_to_bind_addrs() to read beyond the end of the cookie. The\naddress parser also lacks sufficient bounds checks for parameter headers\nand lengths, allowing malformed address parameters to trigger\nout-of-bounds reads.\n\nFix this by:\n\n- requiring the embedded INIT chunk length to be at least sizeof(struct\n sctp_init_chunk);\n- validating that the INIT chunk and raw address list together fit\n within the cookie payload;\n- verifying sufficient data exists for each address parameter header and\n payload before parsing it.\n\nNote that sctp_verify_init() must be called after sctp_unpack_cookie()\nand before sctp_process_init() when cookie authentication is disabled.\nThis will be addressed in a separate patch."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - An unauthenticated remote SCTP peer can reach the vulnerable COOKIE_ECHO processing path by sending SCTP packets to a listening SCTP endpoint. In deployments with cookie HMAC disabled, the attacker can obtain and modify the state cookie over the network.\nAC:L - The bug is triggered with a malformed COOKIE_ECHO and attacker-controlled embedded INIT/address-list lengths; no race or hard-to-control timing condition is required. The no-cookie-auth deployment condition is a reasonable supported SCTP configuration.\nPR:N - No credentials or local privileges are needed to send SCTP INIT/COOKIE_ECHO traffic to a listening service. The vulnerable parsing occurs before any application authentication.\nUI:N - Exploitation only requires sending network packets to the target SCTP endpoint. No victim user action is required.\nS:U - The impact is within the kernel/network stack security authority of the target system. It does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The malformed lengths can drive out-of-bounds kernel reads beyond the COOKIE_ECHO payload, including attacker-controlled oversized address-list parsing. Because the read is not strictly bounded to a few bytes and related SCTP COOKIE_ECHO bugs demonstrate kernel memory leakage potential, confidentiality impact is High.\nI:N - The investigated fix addresses out-of-bounds reads and missing length validation, not an out-of-bounds write or direct arbitrary memory modification primitive. I did not find a defensible direct integrity impact from this bug alone.\nA:H - The attacker-controlled out-of-bounds reads can walk beyond the skb/cookie buffer and fault or trigger KASAN/oops conditions. A remotely triggerable kernel crash is High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:26:45.107Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b1ca7dcfb335caa2c73d2d1bb5710e6dea2c11e0"
},
{
"url": "https://git.kernel.org/stable/c/dd75066882ecc4ec8df3f5384b4b9fa9579be8f0"
},
{
"url": "https://git.kernel.org/stable/c/29ab56e7660b6f849c10c46e87e085649df751eb"
},
{
"url": "https://git.kernel.org/stable/c/7560afb8cddafd829e709d7ea09230e45a825557"
},
{
"url": "https://git.kernel.org/stable/c/512a9bb77c04ac9927648ea58af617e472be96e6"
},
{
"url": "https://git.kernel.org/stable/c/6f4c80a2a7e6d06753b89a578b710a2499a5e62b"
}
],
"title": "sctp: validate embedded INIT chunk and address list lengths in cookie",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53224",
"datePublished": "2026-06-25T08:39:25.254Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-10-30T12:26:45.107Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68155 (GCVE-0-2026-68155)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: Reject monmaps advertising zero monitors
A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a
monitor to the client. This monmap contains information about the
existing monitors in the cluster. Currently, a monmap indicating that
there are zero monitors in the cluster is treated as valid. However, it
is impossible to have zero monitors in the cluster and still receive a
valid monmap from a monitor. Therefore, such a monmap must be corrupted
and should be treated as invalid. Furthermore, a monmap with a monitor
count of zero can subsequently crash the client when attempting to open
a session with a monitor in __open_session(). This happens because the
"BUG_ON(monc->monmap->num_mon < 1)" assertion in pick_new_mon() is
triggered.
This patch extends a check in ceph_monmap_decode() to also reject
arriving mon_maps with num_mon == 0 rather than only with
num_mon > CEPH_MAX_MON.
[ idryomov: drop "log output for unusual values of num_mon" part ]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ba75bb98cfb93b62c54af25bf67ff90857264bbe Version: ba75bb98cfb93b62c54af25bf67ff90857264bbe Version: ba75bb98cfb93b62c54af25bf67ff90857264bbe Version: ba75bb98cfb93b62c54af25bf67ff90857264bbe Version: ba75bb98cfb93b62c54af25bf67ff90857264bbe Version: ba75bb98cfb93b62c54af25bf67ff90857264bbe Version: ba75bb98cfb93b62c54af25bf67ff90857264bbe Version: ba75bb98cfb93b62c54af25bf67ff90857264bbe |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68155",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:45:06.305922Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:54.643Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/mon_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ba5f0015bfd376d764163045a61c17be75f44dae",
"status": "affected",
"version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
"versionType": "git"
},
{
"lessThan": "caf082ef8609a6ac26159ce115f55ab7d00231a3",
"status": "affected",
"version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
"versionType": "git"
},
{
"lessThan": "e3ccd4ecab09b22f507f49cb7ed9990c7158ceab",
"status": "affected",
"version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
"versionType": "git"
},
{
"lessThan": "0591a15815b498be628a937146e44487d599ba33",
"status": "affected",
"version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
"versionType": "git"
},
{
"lessThan": "cd0d41bc569632eaaeccde9d2a6bc919ec00c407",
"status": "affected",
"version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
"versionType": "git"
},
{
"lessThan": "e67e8b694872c9bc66996040f9de9242f6236ed9",
"status": "affected",
"version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
"versionType": "git"
},
{
"lessThan": "3b249546f59c3d6d3592c10657f82bc3f1faa07c",
"status": "affected",
"version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
"versionType": "git"
},
{
"lessThan": "40480eee361ed9676b3f844d532ac28b47251634",
"status": "affected",
"version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/mon_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Reject monmaps advertising zero monitors\n\nA message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a\nmonitor to the client. This monmap contains information about the\nexisting monitors in the cluster. Currently, a monmap indicating that\nthere are zero monitors in the cluster is treated as valid. However, it\nis impossible to have zero monitors in the cluster and still receive a\nvalid monmap from a monitor. Therefore, such a monmap must be corrupted\nand should be treated as invalid. Furthermore, a monmap with a monitor\ncount of zero can subsequently crash the client when attempting to open\na session with a monitor in __open_session(). This happens because the\n\"BUG_ON(monc-\u003emonmap-\u003enum_mon \u003c 1)\" assertion in pick_new_mon() is\ntriggered.\n\nThis patch extends a check in ceph_monmap_decode() to also reject\narriving mon_maps with num_mon == 0 rather than only with\nnum_mon \u003e CEPH_MAX_MON.\n\n[ idryomov: drop \"log output for unusual values of num_mon\" part ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached when libceph decodes CEPH_MSG_MON_MAP from a remote Ceph monitor over the kernel client\u0027s established TCP/msgr2 session (mon_dispatch -\u003e ceph_monc_handle_map -\u003e ceph_monmap_decode), which is a network protocol attack surface on CephFS/RBD/cloud nodes.\nAC:L - An attacker who can send monitor protocol messages only needs to set num_mon=0 in the monmap; once accepted, any later session reopen (keepalive timeout, hunt, or connection fault) deterministically hits BUG_ON in pick_new_mon without races or special memory layout.\nPR:N - In the highest-impact scenario a malicious or compromised Ceph monitor (or equivalent authenticated cluster peer) sends the malformed monmap to already-connected kernel clients; the attacker needs no local privileges on the victim host.\nUI:N - After a Ceph client session exists, monmap updates are delivered and processed automatically by the kernel monitor client; no further mount, open, or other victim interaction is required to accept the bad map and later crash on reconnect.\nS:U - Exploitation causes a kernel BUG/panic within the same kernel security domain and does not cross VM, container, IOMMU, or other security boundaries.\nC:N - The failure mode is a BUG_ON assertion in pick_new_mon when num_mon is zero; there is no memory corruption, out-of-bounds access, or other information disclosure primitive on the vulnerable path.\nI:N - Accepting num_mon==0 only stores an empty monmap and later triggers a deliberate kernel BUG; attacker input does not corrupt or modify arbitrary kernel memory or enable code execution.\nA:H - BUG_ON(monc-\u003emonmap-\u003enum_mon \u003c 1) in pick_new_mon during __open_session causes a kernel oops/panic, fully denying availability of the affected host until reboot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T10:55:38.556Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ba5f0015bfd376d764163045a61c17be75f44dae"
},
{
"url": "https://git.kernel.org/stable/c/caf082ef8609a6ac26159ce115f55ab7d00231a3"
},
{
"url": "https://git.kernel.org/stable/c/e3ccd4ecab09b22f507f49cb7ed9990c7158ceab"
},
{
"url": "https://git.kernel.org/stable/c/0591a15815b498be628a937146e44487d599ba33"
},
{
"url": "https://git.kernel.org/stable/c/cd0d41bc569632eaaeccde9d2a6bc919ec00c407"
},
{
"url": "https://git.kernel.org/stable/c/e67e8b694872c9bc66996040f9de9242f6236ed9"
},
{
"url": "https://git.kernel.org/stable/c/3b249546f59c3d6d3592c10657f82bc3f1faa07c"
},
{
"url": "https://git.kernel.org/stable/c/40480eee361ed9676b3f844d532ac28b47251634"
}
],
"title": "libceph: Reject monmaps advertising zero monitors",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68155",
"datePublished": "2026-08-10T11:59:21.200Z",
"dateReserved": "2026-07-30T09:28:09.371Z",
"dateUpdated": "2026-10-19T20:58:54.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93787 (GCVE-0-2026-93787)
Vulnerability from cvelistv5
Published
2026-09-24 16:02
Modified
2026-10-03 10:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: bound dirent name against end of SMB response in cifs_filldir
cifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST /
FIND_NEXT response using a length (de.namelen) supplied by the server.
The kmalloc'd SMB response buffer is bounded, but nothing checks that
de.name + de.namelen still lies inside that buffer before the eventual
filldir64() -> verify_dirent_name() -> memchr() reads namelen bytes.
A hostile SMB1 server that returns an oversized FileNameLength in a
directory entry therefore causes memchr() to read past the end of the
response slab buffer. Reachable from any user who can list a directory
on a CIFS mount served by an attacker-controlled server (getdents64()
on the mounted directory):
BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80
Read of size 1 at addr ffff88800e0640cc by task poc/115
Call Trace:
dump_stack_lvl+0x64/0x80
print_report+0xce/0x620
kasan_report+0xec/0x120
memchr+0x71/0x80
filldir64+0x4c/0x6a0
cifs_filldir.constprop.0+0x9bb/0x1e00
cifs_readdir+0x2101/0x3380
iterate_dir+0x19c/0x520
__x64_sys_getdents64+0x126/0x210
do_syscall_64+0x107/0x5a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Pass the end-of-response pointer down to cifs_filldir() and reject
entries whose name would extend past that boundary.
This bug was discovered by Artiphishell's vTriage pipeline, which
generated a userspace reproducer (an emulated hostile SMB1 server plus
a getdents64() client) that reliably triggers the KASAN report on an
unpatched kernel. The fix below was drafted with the Claude coding
assistant; a userspace reproducer is available on request.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/readdir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4cb3d79beee0fecc739ce07af915d503f29ae557",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "cf87ef1e62ed31a439064cef69d6eec38c68bd92",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6e3b965267b7313903baba2739992b1e2e92d540",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "03003506c86f90312b0966283662c42fcab66e4b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/readdir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: bound dirent name against end of SMB response in cifs_filldir\n\ncifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST /\nFIND_NEXT response using a length (de.namelen) supplied by the server.\nThe kmalloc\u0027d SMB response buffer is bounded, but nothing checks that\nde.name + de.namelen still lies inside that buffer before the eventual\nfilldir64() -\u003e verify_dirent_name() -\u003e memchr() reads namelen bytes.\n\nA hostile SMB1 server that returns an oversized FileNameLength in a\ndirectory entry therefore causes memchr() to read past the end of the\nresponse slab buffer. Reachable from any user who can list a directory\non a CIFS mount served by an attacker-controlled server (getdents64()\non the mounted directory):\n\n BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80\n Read of size 1 at addr ffff88800e0640cc by task poc/115\n Call Trace:\n dump_stack_lvl+0x64/0x80\n print_report+0xce/0x620\n kasan_report+0xec/0x120\n memchr+0x71/0x80\n filldir64+0x4c/0x6a0\n cifs_filldir.constprop.0+0x9bb/0x1e00\n cifs_readdir+0x2101/0x3380\n iterate_dir+0x19c/0x520\n __x64_sys_getdents64+0x126/0x210\n do_syscall_64+0x107/0x5a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nPass the end-of-response pointer down to cifs_filldir() and reject\nentries whose name would extend past that boundary.\n\nThis bug was discovered by Artiphishell\u0027s vTriage pipeline, which\ngenerated a userspace reproducer (an emulated hostile SMB1 server plus\na getdents64() client) that reliably triggers the KASAN report on an\nunpatched kernel. The fix below was drafted with the Claude coding\nassistant; a userspace reproducer is available on request."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - cifs_filldir() takes FileNameLength from an SMB1 TRANS2_FIND_FIRST/FIND_NEXT directory entry received over TCP/445; CIFSFindFirst() stores that PDU in srch_inf.ntwrk_buf_start and getdents64\u2192iterate_dir\u2192cifs_readdir() passes each entry to cifs_filldir(), so the oversized name length is protocol data from the remote SMB peer.\nAC:L - The hostile SMB1 server sets FileNameLength (cifs_fill_dirent_dir/full/search/both) and Flags2 unicode and can place FileName near the end of the CIFSFindFirst buffer so de.name+de.namelen exceeds end_of_smb; the old namelen\u003emax_len check only compared against the whole SMB size, so the overread is deterministic with no race.\nPR:N - The attacker is the remote SMB1 server (or a MITM on an unsigned SMB1 session) that returns the FIND_FIRST/FIND_NEXT payload; CIFSFindFirst() and cifs_filldir() use the victim\u0027s existing tcon and impose no account or capability check on that peer.\nUI:R - cifs_filldir() is reached only from cifs_dir_ops.iterate_shared (cifs_readdir) on getdents64\u2192iterate_dir; the SMB1 server cannot inject an unsolicited FIND response into that path, so a victim process must list a directory on the CIFS mount.\nS:U - The slab-out-of-bounds read in filldir64\u0027s verify_dirent_name()/memchr() stays inside the client kernel\u0027s CIFS response buffer on the same host; this is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - FileNameLength can be just under PATH_MAX while de.name sits at the end of the kmalloc\u0027d FIND response, so memchr() and filldir64\u0027s unsafe_copy_dirent_name() read up to ~4095 bytes of adjacent kernel heap and copy them into the getdents64 userspace buffer.\nI:N - The defect is an over-read of the FIND entry name; cifs_filldir() does not write past the SMB buffer, and filldir64 only copies the over-read bytes to the caller\u0027s dirent buffer, giving no kernel write or control-flow primitive.\nA:H - KASAN reports a slab-out-of-bounds read in memchr() from filldir64\u2190cifs_filldir on the hostile FileNameLength; walking those bytes off the cifs_request object into an unmapped page oopses or panics the client, and the server can retrigger it on every getdents64."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T10:57:22.488Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4cb3d79beee0fecc739ce07af915d503f29ae557"
},
{
"url": "https://git.kernel.org/stable/c/cf87ef1e62ed31a439064cef69d6eec38c68bd92"
},
{
"url": "https://git.kernel.org/stable/c/6e3b965267b7313903baba2739992b1e2e92d540"
},
{
"url": "https://git.kernel.org/stable/c/03003506c86f90312b0966283662c42fcab66e4b"
},
{
"url": "https://git.kernel.org/stable/c/f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6"
}
],
"title": "smb: client: bound dirent name against end of SMB response in cifs_filldir",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93787",
"datePublished": "2026-09-24T16:02:20.872Z",
"dateReserved": "2026-09-18T17:59:28.788Z",
"dateUpdated": "2026-10-03T10:57:22.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89846 (GCVE-0-2026-89846)
Vulnerability from cvelistv5
Published
2026-09-16 10:31
Modified
2026-10-19 08:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
In qla2x00_status_entry(), the FWI2 status path advances sense_data and
shrinks par_sense_len by rsp_info_len:
if (IS_FWI2_CAPABLE(ha)) {
sense_data += rsp_info_len;
par_sense_len -= rsp_info_len;
}
rsp_info_len is a 32-bit value taken directly from the target's FCP
response (sf.rsp_data_len), while par_sense_len is the IOCB data area
size (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target
reporting an rsp_info_len larger than par_sense_len makes the unsigned
subtraction underflow to a huge value and advances sense_data out of
bounds.
The underflowed par_sense_len then defeats the cap in
qla2x00_handle_sense():
if (sense_len > par_sense_len)
sense_len = par_sense_len;
memcpy(cp->sense_buffer, sense_data, sense_len);
so the memcpy reads up to SCSI_SENSE_BUFFERSIZE bytes from the
out-of-bounds sense_data pointer, leaking adjacent response-ring/heap
memory into the command's sense buffer.
Clamp rsp_info_len to par_sense_len before the subtraction so
par_sense_len can never underflow and sense_data stays within the IOCB
data area. The fix sits before the comp_status switch, covering both
qla2x00_handle_sense() call sites.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 Version: 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 Version: 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 Version: 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 Version: 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 Version: 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 Version: 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 Version: 5544213be7b4fb693730106a6d70a8cc1aa7cdf6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_isr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "125b12861c726e58448bb95d55b04851fb131d1f",
"status": "affected",
"version": "5544213be7b4fb693730106a6d70a8cc1aa7cdf6",
"versionType": "git"
},
{
"lessThan": "e57ace988bda5693f7b3645f652ea4b4220870ee",
"status": "affected",
"version": "5544213be7b4fb693730106a6d70a8cc1aa7cdf6",
"versionType": "git"
},
{
"lessThan": "6b08c0cb110a1fba92f99d655020198489699815",
"status": "affected",
"version": "5544213be7b4fb693730106a6d70a8cc1aa7cdf6",
"versionType": "git"
},
{
"lessThan": "be75ab791c9b3baca66c70ce03443afebc83acda",
"status": "affected",
"version": "5544213be7b4fb693730106a6d70a8cc1aa7cdf6",
"versionType": "git"
},
{
"lessThan": "ebc41dfc59d190956e0113e8bd90c28f6f21e8b9",
"status": "affected",
"version": "5544213be7b4fb693730106a6d70a8cc1aa7cdf6",
"versionType": "git"
},
{
"lessThan": "d7f7746ff031ae45724881261804f4bf5317c985",
"status": "affected",
"version": "5544213be7b4fb693730106a6d70a8cc1aa7cdf6",
"versionType": "git"
},
{
"lessThan": "f6e8977bce887481b2b2b0e2e14a791270741cfb",
"status": "affected",
"version": "5544213be7b4fb693730106a6d70a8cc1aa7cdf6",
"versionType": "git"
},
{
"lessThan": "ca6d880d6c70cb7946e7b3e05d7285f271b6d99e",
"status": "affected",
"version": "5544213be7b4fb693730106a6d70a8cc1aa7cdf6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_isr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.36"
},
{
"lessThan": "2.6.36",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read\n\nIn qla2x00_status_entry(), the FWI2 status path advances sense_data and\nshrinks par_sense_len by rsp_info_len:\n\n\tif (IS_FWI2_CAPABLE(ha)) {\n\t\tsense_data += rsp_info_len;\n\t\tpar_sense_len -= rsp_info_len;\n\t}\n\nrsp_info_len is a 32-bit value taken directly from the target\u0027s FCP\nresponse (sf.rsp_data_len), while par_sense_len is the IOCB data area\nsize (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target\nreporting an rsp_info_len larger than par_sense_len makes the unsigned\nsubtraction underflow to a huge value and advances sense_data out of\nbounds.\n\nThe underflowed par_sense_len then defeats the cap in\nqla2x00_handle_sense():\n\n\tif (sense_len \u003e par_sense_len)\n\t\tsense_len = par_sense_len;\n\tmemcpy(cp-\u003esense_buffer, sense_data, sense_len);\n\nso the memcpy reads up to SCSI_SENSE_BUFFERSIZE bytes from the\nout-of-bounds sense_data pointer, leaking adjacent response-ring/heap\nmemory into the command\u0027s sense buffer.\n\nClamp rsp_info_len to par_sense_len before the subtraction so\npar_sense_len can never underflow and sense_data stays within the IOCB\ndata area. The fix sits before the comp_status switch, covering both\nqla2x00_handle_sense() call sites."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - qla2xxx builds initiator status IOCBs from a remote Fibre Channel or FCoE target\u0027s FCP_RSP; QLogic CNAs speak FCoE and SAN fabrics are stretched across sites via FCIP/inter-fabric routing, so a malicious or compromised target delivers the crafted rsp_data_len over the storage network with no local access.\nAC:L - A hostile target fully controls FCP_RSP (SS_RESPONSE_INFO_LEN_VALID, rsp_data_len, sense_len, CHECK CONDITION, rsp_info[3]==0) and can return them on ordinary initiator I/O such as INQUIRY during fabric scan; no race, rare config, or victim state beyond a FWI2-capable HBA is required.\nPR:N - Completions are handled in the HBA interrupt/response-queue path (qla24xx_process_response_queue to qla2x00_status_entry) with no Linux credential or capability check; the attacker only needs to act as an FC/FCoE target on the fabric.\nUI:N - Once the target is visible on the fabric, the SCSI midlayer automatically issues commands (scan, path checks, mounted-filesystem I/O) whose STATUS_TYPE completions take the vulnerable path; no user mount, open, or other interactive step is required at exploit time.\nS:U - The out-of-bounds read and any resulting oops stay inside the host kernel that owns the qla2xxx driver and do not cross a VM, IOMMU, or other separate security authority.\nC:H - Attacker-controlled 32-bit rsp_info_len advances sense_data out of the 28-byte IOCB data area and underflows par_sense_len so qla2x00_handle_sense() copies up to SCSI_SENSE_BUFFERSIZE (96) bytes of adjacent response-ring or kernel memory into the command sense buffer, which userspace can read via SCSI completion, SG_IO, and BSG.\nI:N - The memcpy destination is the in-bounds SCSI sense buffer already capped at SCSI_SENSE_BUFFERSIZE; this is a source over-read only, with no out-of-bounds write, use-after-free, or control-flow hijack primitive.\nA:H - Adding a 32-bit attacker-chosen rsp_info_len to sense_data yields a wild kernel pointer; memcpy from an unmapped address in the interrupt-context response-queue path oopses or panics the host, and the target can repeat this on every command."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:53:39.169Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/125b12861c726e58448bb95d55b04851fb131d1f"
},
{
"url": "https://git.kernel.org/stable/c/e57ace988bda5693f7b3645f652ea4b4220870ee"
},
{
"url": "https://git.kernel.org/stable/c/6b08c0cb110a1fba92f99d655020198489699815"
},
{
"url": "https://git.kernel.org/stable/c/be75ab791c9b3baca66c70ce03443afebc83acda"
},
{
"url": "https://git.kernel.org/stable/c/ebc41dfc59d190956e0113e8bd90c28f6f21e8b9"
},
{
"url": "https://git.kernel.org/stable/c/d7f7746ff031ae45724881261804f4bf5317c985"
},
{
"url": "https://git.kernel.org/stable/c/f6e8977bce887481b2b2b0e2e14a791270741cfb"
},
{
"url": "https://git.kernel.org/stable/c/ca6d880d6c70cb7946e7b3e05d7285f271b6d99e"
}
],
"title": "scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89846",
"datePublished": "2026-09-16T10:31:20.306Z",
"dateReserved": "2026-09-11T19:38:34.770Z",
"dateUpdated": "2026-10-19T08:53:39.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63802 (GCVE-0-2026-63802)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-10-19 20:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: fix UAF in __blkcg_rstat_flush()
When multiple blkgs in the same blkcg are released concurrently,
a use-after-free can occur. The race happens when one blkg's
__blkcg_rstat_flush() removes another blkg's iostat entries via
llist_del_all(). The second blkg sees an empty list and proceeds
to free itself while the first is still iterating over its entries.
Move the flush from __blkg_release() (RCU callback) to blkg_release()
(before call_rcu). This ensures the RCU grace period waits for any
concurrent flush's rcu_read_lock() section to complete before freeing.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 20cb1c2fb7568a6054c55defe044311397e01ddb Version: 20cb1c2fb7568a6054c55defe044311397e01ddb Version: 20cb1c2fb7568a6054c55defe044311397e01ddb Version: 20cb1c2fb7568a6054c55defe044311397e01ddb Version: 20cb1c2fb7568a6054c55defe044311397e01ddb Version: 0f6090d90f627d8c58f939067d6c6821ce1b3c68 Version: 6.3.9 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63802",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:30:46.711290Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:07:47.815Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/blk-cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "96e545410c4f74c89d496c1d5d9ef8d08f14368b",
"status": "affected",
"version": "20cb1c2fb7568a6054c55defe044311397e01ddb",
"versionType": "git"
},
{
"lessThan": "bbebd9425cad3573d1527441753899b926525a0f",
"status": "affected",
"version": "20cb1c2fb7568a6054c55defe044311397e01ddb",
"versionType": "git"
},
{
"lessThan": "5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6",
"status": "affected",
"version": "20cb1c2fb7568a6054c55defe044311397e01ddb",
"versionType": "git"
},
{
"lessThan": "afebe44facc48a61761e885bbb7f0380d4a603ec",
"status": "affected",
"version": "20cb1c2fb7568a6054c55defe044311397e01ddb",
"versionType": "git"
},
{
"lessThan": "0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2",
"status": "affected",
"version": "20cb1c2fb7568a6054c55defe044311397e01ddb",
"versionType": "git"
},
{
"status": "affected",
"version": "0f6090d90f627d8c58f939067d6c6821ce1b3c68",
"versionType": "git"
},
{
"lessThan": "6.4",
"status": "affected",
"version": "6.3.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/blk-cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix UAF in __blkcg_rstat_flush()\n\nWhen multiple blkgs in the same blkcg are released concurrently,\na use-after-free can occur. The race happens when one blkg\u0027s\n__blkcg_rstat_flush() removes another blkg\u0027s iostat entries via\nllist_del_all(). The second blkg sees an empty list and proceeds\nto free itself while the first is still iterating over its entries.\n\nMove the flush from __blkg_release() (RCU callback) to blkg_release()\n(before call_rcu). This ensures the RCU grace period waits for any\nconcurrent flush\u0027s rcu_read_lock() section to complete before freeing."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local cgroup management (rmdir on cgroupfs) and concurrent block I/O to populate per-blkcg rstat lists; the vulnerable code is in the block cgroup teardown path, not in any network protocol handler.\nAC:L - The attacker controls both sides of the race by issuing I/O on multiple block devices to create multiple blkgs with pending stats, then concurrently destroying the cgroup to trigger parallel blkg_release() calls on multiple CPUs.\nPR:L - Triggering cgroup deletion and block I/O requires only delegated cgroup write access or namespace/container root (CAP_SYS_ADMIN in a user namespace), not init-namespace root; this is routinely available in containers, Kubernetes pods, and systemd user cgroup hierarchies.\nUI:N - No victim interaction is required; the attacker programmatically performs I/O and cgroup teardown from their own process or container.\nS:U - The UAF corrupts kernel heap memory within the same kernel security domain; it does not inherently cross a VM, container, or IOMMU boundary without a separate privilege-escalation step.\nC:H - The use-after-free dereferences freed blkg structures and associated iostat data during list iteration, enabling arbitrary kernel memory read primitives typical of slab UAF bugs.\nI:H - UAF on kmalloc-allocated blkg objects allows heap grooming and write through dangling pointers, which can be leveraged for arbitrary kernel memory modification or code execution.\nA:H - Concurrent use-after-free during blkg teardown can cause immediate kernel oops/panic from accessing freed memory, and repeated triggering enables reliable denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:51:07.787Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/96e545410c4f74c89d496c1d5d9ef8d08f14368b"
},
{
"url": "https://git.kernel.org/stable/c/bbebd9425cad3573d1527441753899b926525a0f"
},
{
"url": "https://git.kernel.org/stable/c/5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6"
},
{
"url": "https://git.kernel.org/stable/c/afebe44facc48a61761e885bbb7f0380d4a603ec"
},
{
"url": "https://git.kernel.org/stable/c/0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2"
}
],
"title": "blk-cgroup: fix UAF in __blkcg_rstat_flush()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63802",
"datePublished": "2026-07-19T12:02:08.020Z",
"dateReserved": "2026-07-19T07:54:57.013Z",
"dateUpdated": "2026-10-19T20:07:47.815Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74556 (GCVE-0-2026-74556)
Vulnerability from cvelistv5
Published
2026-08-15 12:28
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
iscsi_tcp_hdr_dissect() receives the data segment of several PDU types
into the fixed-size conn->data buffer, which is allocated for
ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP,
REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU
whose DataSegmentLength exceeds that buffer.
The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its
data segment (sense/response data) into conn->data via
iscsi_tcp_data_recv_prep(), but it does so without the same check. The
only upstream bound on in.datalen is conn->max_recv_dlength, the
initiator's advertised MaxRecvDataSegmentLength, which is commonly
negotiated well above 8192 (open-iscsi defaults to 262144). A target
that returns a SCSI Response with a DataSegmentLength between 8193 and
max_recv_dlength therefore overflows the 8192-byte conn->data buffer.
Once the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly
like those responses: bound the data segment, receive it into conn->data
when present, and otherwise complete the PDU with no data. Fold the
opcode into that case group rather than duplicating the check.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a081c13e39b5c17052a7b46fafa61019c4c110ff Version: a081c13e39b5c17052a7b46fafa61019c4c110ff Version: a081c13e39b5c17052a7b46fafa61019c4c110ff Version: a081c13e39b5c17052a7b46fafa61019c4c110ff Version: a081c13e39b5c17052a7b46fafa61019c4c110ff Version: a081c13e39b5c17052a7b46fafa61019c4c110ff Version: a081c13e39b5c17052a7b46fafa61019c4c110ff Version: a081c13e39b5c17052a7b46fafa61019c4c110ff |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74556",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:00:06.190671Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:55.568Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libiscsi_tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a51812842084fd390590ab8dc0431f10c73ddc56",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "a8f94cc9f0e5759252551be3a172960c57f21f54",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "f1a3a51fc5dba0e99532379665069f1700da6b44",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "c97b5265cc47775f77fd2a23d6bde0426997b233",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "084af0253673425ce2ae62e3c7f74f0dd023711b",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "72815741715bd41556dac5eeb068bf0f8af06ee7",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "c1dea15f819cded9b3faf58f8bec72323568b6e6",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libiscsi_tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer\n\niscsi_tcp_hdr_dissect() receives the data segment of several PDU types\ninto the fixed-size conn-\u003edata buffer, which is allocated for\nISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP,\nREJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU\nwhose DataSegmentLength exceeds that buffer.\n\nThe SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its\ndata segment (sense/response data) into conn-\u003edata via\niscsi_tcp_data_recv_prep(), but it does so without the same check. The\nonly upstream bound on in.datalen is conn-\u003emax_recv_dlength, the\ninitiator\u0027s advertised MaxRecvDataSegmentLength, which is commonly\nnegotiated well above 8192 (open-iscsi defaults to 262144). A target\nthat returns a SCSI Response with a DataSegmentLength between 8193 and\nmax_recv_dlength therefore overflows the 8192-byte conn-\u003edata buffer.\n\nOnce the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly\nlike those responses: bound the data segment, receive it into conn-\u003edata\nwhen present, and otherwise complete the PDU with no data. Fold the\nopcode into that case group rather than duplicating the check."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious or compromised iSCSI target delivers crafted SCSI Command Response PDUs over the established TCP iSCSI session; reception flows through iscsi_sw_tcp_recv/iscsi_tcp_recv_skb into iscsi_tcp_hdr_dissect without local access.\nAC:L - The attacker controls the target and can set DataSegmentLength between 8193 and negotiated max_recv_dlength (open-iscsi commonly 262144) on SCSI_CMD_RSP for any outstanding command ITT; no races or victim-specific heap layout are required.\nPR:N - No privileges on the victim host are needed; a remote attacker acting as or MITMing the iSCSI target sends malicious responses after session login, independent of victim user accounts or capabilities.\nUI:N - On systems with persistent iSCSI sessions (cloud VMs, SAN-boot hosts, Kubernetes iSCSI volumes), exploitation triggers automatically during normal SCSI I/O when command responses are received; no victim action is needed at attack time.\nS:U - Heap corruption is confined to the kernel iSCSI initiator on the affected host; successful exploitation yields kernel compromise or DoS within the same security authority, not a VM escape or cross-boundary scope change.\nC:H - iscsi_tcp_segment_recv memcpy writes up to max_recv_dlength bytes into an 8192-byte conn-\u003edata buffer, causing a large heap overflow whose controlled corruption can be leveraged for arbitrary kernel memory disclosure.\nI:H - Attacker-controlled response data is copied past the fixed conn-\u003edata allocation via iscsi_tcp_data_recv_prep/iscsi_segment_init_linear, enabling heap metadata/object corruption exploitable for arbitrary kernel write and privilege escalation.\nA:H - Overflowing the conn-\u003edata heap buffer can immediately corrupt adjacent kernel allocations and cause oops/panic; a malicious target can repeatedly trigger this on active sessions to deny storage availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:38:57.393Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a51812842084fd390590ab8dc0431f10c73ddc56"
},
{
"url": "https://git.kernel.org/stable/c/a8f94cc9f0e5759252551be3a172960c57f21f54"
},
{
"url": "https://git.kernel.org/stable/c/f1a3a51fc5dba0e99532379665069f1700da6b44"
},
{
"url": "https://git.kernel.org/stable/c/c97b5265cc47775f77fd2a23d6bde0426997b233"
},
{
"url": "https://git.kernel.org/stable/c/084af0253673425ce2ae62e3c7f74f0dd023711b"
},
{
"url": "https://git.kernel.org/stable/c/72815741715bd41556dac5eeb068bf0f8af06ee7"
},
{
"url": "https://git.kernel.org/stable/c/b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676"
},
{
"url": "https://git.kernel.org/stable/c/c1dea15f819cded9b3faf58f8bec72323568b6e6"
}
],
"title": "scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74556",
"datePublished": "2026-08-15T12:28:01.359Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-10-16T19:05:55.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98466 (GCVE-0-2026-98466)
Vulnerability from cvelistv5
Published
2026-10-18 15:15
Modified
2026-10-24 14:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Transfer the hyp stack pages out of the host stage-2
fix_host_ownership() walks only the linear-map alias of each memblock
region, and the per-CPU hyp stack, mapped in the private VA range for
its guard page, has none.
Walk each stack's VA range with the same walker.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/hyp/nvhe/setup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e5dd2a91a7ae3a276e6d79806127e923936e241b",
"status": "affected",
"version": "1a919b17ef012ca0572bae759c27e5ea02bfb47f",
"versionType": "git"
},
{
"lessThan": "22df195bff84300a3f04813d6148765c77ac565a",
"status": "affected",
"version": "1a919b17ef012ca0572bae759c27e5ea02bfb47f",
"versionType": "git"
},
{
"lessThan": "3a8c562892b96f35bba1e00d5e455a15963bbb92",
"status": "affected",
"version": "1a919b17ef012ca0572bae759c27e5ea02bfb47f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/hyp/nvhe/setup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Transfer the hyp stack pages out of the host stage-2\n\nfix_host_ownership() walks only the linear-map alias of each memblock\nregion, and the per-CPU hyp stack, mapped in the private VA range for\nits guard page, has none.\n\nWalk each stack\u0027s VA range with the same walker."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The local `module_init(kvm_arm_init)` path reaches `init_hyp_mode()` \u2192 `kvm_hyp_init_protection()` \u2192 `do_pkvm_init()` \u2192 `handle___pkvm_init()` \u2192 `__pkvm_init()` \u2192 `__pkvm_init_finalise()` \u2192 patched `fix_host_ownership()`. Exploitation accesses the omitted stack pages through host direct-map aliases; no wire or guest message supplies causal data.\nAC:L - With `kvm-arm.mode=protected`, the omitted pages retain host-owned state, so `handle_host_mem_abort()` \u2192 `host_stage2_idmap()` deterministically installs `PKVM_HOST_MEM_PROT` RWX mappings. The attacker controls the stack access and a following HVC; no race or external condition is required.\nPR:H - `/dev/kvm` ioctls only cause EL2 to use the stack; they do not expose `kvm_arm_hyp_stack_base` or its PFN. Writing the kernel direct-map alias requires control of host EL1 through real host-administrative privilege, unavailable through user namespaces.\nUI:N - After pKVM initialization, the host attacker can access the retained direct-map alias and invoke an HVC or `KVM_RUN` to make EL2 use the corrupted stack. No action by another user is required.\nS:C - The missing `host_stage2_set_owner_locked(..., PKVM_ID_HYP)` operation lets the host EL1 authority access the protected EL2 stack, crossing the stage-2 boundary that isolates the hypervisor and protected VMs.\nC:H - The host can read live EL2 stack contents, including saved registers and pointers. Its simultaneous write access to stack control data can hijack EL2 execution and expose hypervisor or protected-VM memory.\nI:H - The host can overwrite the active stack used by `__host_exit()` and `handle_trap()`, including saved frame and return state. Control-flow corruption at EL2 can modify hypervisor ownership metadata and protected-VM memory.\nA:H - Corrupting the per-CPU stack consumed on every host-to-EL2 trap can produce invalid returns or hypervisor faults, crashing the hypervisor and consequently the host or its protected VMs."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:08:58.562Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e5dd2a91a7ae3a276e6d79806127e923936e241b"
},
{
"url": "https://git.kernel.org/stable/c/22df195bff84300a3f04813d6148765c77ac565a"
},
{
"url": "https://git.kernel.org/stable/c/3a8c562892b96f35bba1e00d5e455a15963bbb92"
}
],
"title": "KVM: arm64: Transfer the hyp stack pages out of the host stage-2",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98466",
"datePublished": "2026-10-18T15:15:18.414Z",
"dateReserved": "2026-09-25T10:25:14.351Z",
"dateUpdated": "2026-10-24T14:08:58.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63924 (GCVE-0-2026-63924)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-10-19 20:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers.
Let's recompute nh pointer to make sure any change won't mess things up.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63924",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:33:33.023391Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-822",
"description": "CWE-822 Untrusted Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:56.915Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/exthdrs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b3ac54e5c905f86d22b502eacb5686a282c5659f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "645b99b1a185c91a79bdac4c5de0f91b212d64f0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9e883eaa878f4337b5873c706efb5a192364ed18",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bddaa4dfc7f36e1ee343a0622f69288af2b9ace9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "72af7beae774e46ed543f3f2f267bf0a141bfcdd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c512e1c819dfbf6ae95ee7a44b65b9ad98979157",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2b56bbd928c030894c270cd33d60286326919458",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d47548a36639095939f4747d4c43f2271366f565",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/exthdrs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()\n\nipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers.\nLet\u0027s recompute nh pointer to make sure any change won\u0027t mess things up."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in the IPv6 input path (ipv6_rcv \u2192 ip6_rcv_core \u2192 ipv6_parse_hopopts) triggered by a crafted IPv6 packet with hop-by-hop options containing a Jumbo Payload TLV, reachable from any remote peer that can deliver IPv6 to the host.\nAC:L - An attacker fully controls the crafted IPv6 packet (HBH layout, jumbo length, trailing TLVs) and can send it repeatedly; once the skb is cloned/shared during receive and pskb_trim_rcsum reallocates the head, the stale-pointer UAF is deterministically triggered without races or victim-specific state.\nPR:N - No authentication or local privileges are required; any unauthenticated remote host that can send IPv6 traffic to a listening interface reaches the vulnerable receive handler with no capability or namespace checks along the path.\nUI:N - Exploitation requires only delivery of a malicious IPv6 packet and does not depend on any victim user action such as opening files, clicking links, or mounting filesystems.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary by itself.\nC:H - Continued HBH TLV parsing through the stale nh pointer is a use-after-free read of freed skb head memory, which per kernel guidance enables arbitrary kernel memory disclosure when the freed slab is reused.\nI:H - Stale-pointer UAF during TLV length/type parsing can yield unbounded out-of-bounds reads and corrupt subsequent parsing state, providing memory corruption primitives that can be developed into arbitrary kernel writes or code execution.\nA:H - Dereferencing the freed network-header pointer during TLV parsing can cause immediate kernel oops/panic from invalid memory access, and UAF-triggered parsing errors reliably drop or crash the receive path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:19.118Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f"
},
{
"url": "https://git.kernel.org/stable/c/645b99b1a185c91a79bdac4c5de0f91b212d64f0"
},
{
"url": "https://git.kernel.org/stable/c/9e883eaa878f4337b5873c706efb5a192364ed18"
},
{
"url": "https://git.kernel.org/stable/c/bddaa4dfc7f36e1ee343a0622f69288af2b9ace9"
},
{
"url": "https://git.kernel.org/stable/c/72af7beae774e46ed543f3f2f267bf0a141bfcdd"
},
{
"url": "https://git.kernel.org/stable/c/c512e1c819dfbf6ae95ee7a44b65b9ad98979157"
},
{
"url": "https://git.kernel.org/stable/c/2b56bbd928c030894c270cd33d60286326919458"
},
{
"url": "https://git.kernel.org/stable/c/d47548a36639095939f4747d4c43f2271366f565"
}
],
"title": "ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63924",
"datePublished": "2026-07-19T14:55:25.702Z",
"dateReserved": "2026-07-19T07:54:57.021Z",
"dateUpdated": "2026-10-19T20:17:56.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68476 (GCVE-0-2026-68476)
Vulnerability from cvelistv5
Published
2026-08-15 05:51
Modified
2026-09-02 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvs: reload ip header after head reallocation
__ip_vs_get_out_rt() calls skb_ensure_writable() which may
reallocate skb->head.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8d8e20e2d7bba8c50e64e0eca1cb83956f468e49 Version: 8d8e20e2d7bba8c50e64e0eca1cb83956f468e49 Version: 8d8e20e2d7bba8c50e64e0eca1cb83956f468e49 Version: 8d8e20e2d7bba8c50e64e0eca1cb83956f468e49 Version: 8d8e20e2d7bba8c50e64e0eca1cb83956f468e49 Version: 8d8e20e2d7bba8c50e64e0eca1cb83956f468e49 Version: 8d8e20e2d7bba8c50e64e0eca1cb83956f468e49 Version: 8d8e20e2d7bba8c50e64e0eca1cb83956f468e49 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_xmit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4f2d1151421520d7ae16ca8d367d0ca09f5dfbd7",
"status": "affected",
"version": "8d8e20e2d7bba8c50e64e0eca1cb83956f468e49",
"versionType": "git"
},
{
"lessThan": "657118cad620172dfd8f6ed5717fd75c0d1f7a5a",
"status": "affected",
"version": "8d8e20e2d7bba8c50e64e0eca1cb83956f468e49",
"versionType": "git"
},
{
"lessThan": "a10f5080afbed242640f2984328de25f84557da1",
"status": "affected",
"version": "8d8e20e2d7bba8c50e64e0eca1cb83956f468e49",
"versionType": "git"
},
{
"lessThan": "ac6ac3d35bfc0ade9d17d354c84e503a946ebdab",
"status": "affected",
"version": "8d8e20e2d7bba8c50e64e0eca1cb83956f468e49",
"versionType": "git"
},
{
"lessThan": "e51687fc56c2e39ea6e9532925f1aabd4d529f61",
"status": "affected",
"version": "8d8e20e2d7bba8c50e64e0eca1cb83956f468e49",
"versionType": "git"
},
{
"lessThan": "3fb7edd2018bb1ad0a68157383d9b9dac33dd645",
"status": "affected",
"version": "8d8e20e2d7bba8c50e64e0eca1cb83956f468e49",
"versionType": "git"
},
{
"lessThan": "ad1e14710b360bda087ebf9fb82460eb5ef775de",
"status": "affected",
"version": "8d8e20e2d7bba8c50e64e0eca1cb83956f468e49",
"versionType": "git"
},
{
"lessThan": "a2f57827bf7c695b8c72dc4511cae8e86582369d",
"status": "affected",
"version": "8d8e20e2d7bba8c50e64e0eca1cb83956f468e49",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_xmit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.269",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.220",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.187",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.269",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.220",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.187",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: reload ip header after head reallocation\n\n__ip_vs_get_out_rt() calls skb_ensure_writable() which may\nreallocate skb-\u003ehead."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The flaw is in ip_vs_bypass_xmit() on the IPVS netfilter receive path (NF_INET_LOCAL_IN/FORWARD); remote IPv4 packets to a configured virtual-server VIP reach ip_vs_in_hook() and ip_vs_leave() without local syscalls or ioctl.\nAC:L - Once cache_bypass is enabled on a fwmark IPVS service with no backend, an attacker can repeatedly send traffic to the VIP; cloned skbs (common with bridging, mirroring, or shared receive buffers) make skb_ensure_writable() reallocate skb-\u003ehead deterministically.\nPR:N - Exploitation requires only sending IP packets to the load balancer VIP; IPVS/cache_bypass configuration is an operator prerequisite on the target, not a Linux capability the remote attacker must hold.\nUI:N - No victim interaction is required; kernel processing of attacker-crafted network packets on the IPVS bypass transmit path alone triggers the stale header pointer use after skb head reallocation.\nS:U - Impact is kernel heap corruption and load-balancer compromise within the host kernel security domain; it does not cross VM, container, or IOMMU boundaries to another security authority.\nC:H - After pskb_expand_head() frees the old skb-\u003ehead, ip_send_check() uses the stale iph pointer and ip_fast_csum() reads attacker-influenced bytes from freed kmalloc memory, a classic use-after-free information disclosure primitive.\nI:H - ip_send_check() writes through the stale iph pointer (zeroing and updating the checksum field) into freed/reallocated slab memory, enabling heap corruption and potential arbitrary kernel write or control-flow hijack primitives.\nA:H - Writing and reading through a stale IP header pointer after skb head reallocation can corrupt adjacent kernel heap objects or dereference freed memory, causing kernel oops, panic, or hang and repeatable denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T12:49:42.932Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4f2d1151421520d7ae16ca8d367d0ca09f5dfbd7"
},
{
"url": "https://git.kernel.org/stable/c/657118cad620172dfd8f6ed5717fd75c0d1f7a5a"
},
{
"url": "https://git.kernel.org/stable/c/a10f5080afbed242640f2984328de25f84557da1"
},
{
"url": "https://git.kernel.org/stable/c/ac6ac3d35bfc0ade9d17d354c84e503a946ebdab"
},
{
"url": "https://git.kernel.org/stable/c/e51687fc56c2e39ea6e9532925f1aabd4d529f61"
},
{
"url": "https://git.kernel.org/stable/c/3fb7edd2018bb1ad0a68157383d9b9dac33dd645"
},
{
"url": "https://git.kernel.org/stable/c/ad1e14710b360bda087ebf9fb82460eb5ef775de"
},
{
"url": "https://git.kernel.org/stable/c/a2f57827bf7c695b8c72dc4511cae8e86582369d"
}
],
"title": "ipvs: reload ip header after head reallocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68476",
"datePublished": "2026-08-15T05:51:32.170Z",
"dateReserved": "2026-07-30T09:28:09.396Z",
"dateUpdated": "2026-09-02T12:49:42.932Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89488 (GCVE-0-2026-89488)
Vulnerability from cvelistv5
Published
2026-09-11 19:43
Modified
2026-10-19 08:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: Fix CT limit teardown use-after-free
Packet processing uses CT limit state under RCU, while netns teardown
frees that state under ovs_mutex. The CT limit pointer was neither removed
from readers nor protected by a grace period, allowing packet processing to
dereference the freed state.
An unprivileged user can trigger this bug from a user and network
namespace, causing a slab-use-after-free in ovs_ct_execute() when the
netns is torn down.
Publish the CT limit pointer through RCU, remove it before teardown, and
wait for readers before freeing its contents. Keep ovs_mutex around
individual CT limit updates, and use the RCU read-side lock while GET
traverses the RCU-protected limit lists.
Netns teardown detaches the RCU-protected CT limit state in the pernet
.pre_exit callback while holding ovs_mutex. The pernet core guarantees an
RCU grace period between the .pre_exit and .exit callbacks, so the .exit
callback completes the teardown without adding any extra synchronization.
The netlink command handlers do not need NULL checks because the userspace
netlink socket holds an active reference to its network namespace while a
request is processed. The per-netns exit path therefore cannot run
concurrently with SET, DEL, or GET for that socket's namespace.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 11efd5cb04a184eea4f57b68ea63dddd463158d1 Version: 11efd5cb04a184eea4f57b68ea63dddd463158d1 Version: 11efd5cb04a184eea4f57b68ea63dddd463158d1 Version: 11efd5cb04a184eea4f57b68ea63dddd463158d1 Version: 11efd5cb04a184eea4f57b68ea63dddd463158d1 Version: 11efd5cb04a184eea4f57b68ea63dddd463158d1 Version: 11efd5cb04a184eea4f57b68ea63dddd463158d1 Version: 11efd5cb04a184eea4f57b68ea63dddd463158d1 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89488",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:22:48.434691Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:40.288Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/openvswitch/conntrack.c",
"net/openvswitch/conntrack.h",
"net/openvswitch/datapath.c",
"net/openvswitch/datapath.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "239f26589a6926db28c436e14f28517581ef1385",
"status": "affected",
"version": "11efd5cb04a184eea4f57b68ea63dddd463158d1",
"versionType": "git"
},
{
"lessThan": "3b9369881b403f4cdbb11fa998554382bdcc3d8c",
"status": "affected",
"version": "11efd5cb04a184eea4f57b68ea63dddd463158d1",
"versionType": "git"
},
{
"lessThan": "3b41d907400cc1dd1da9555b81dca422b1f44433",
"status": "affected",
"version": "11efd5cb04a184eea4f57b68ea63dddd463158d1",
"versionType": "git"
},
{
"lessThan": "680f20d5937fa4d1367c59fe83091b78041015f5",
"status": "affected",
"version": "11efd5cb04a184eea4f57b68ea63dddd463158d1",
"versionType": "git"
},
{
"lessThan": "bf4aaa7ea2579e24ed7de2e20578a875bebca011",
"status": "affected",
"version": "11efd5cb04a184eea4f57b68ea63dddd463158d1",
"versionType": "git"
},
{
"lessThan": "e15407c3a8a005324f633cd46cd8fb58042c1157",
"status": "affected",
"version": "11efd5cb04a184eea4f57b68ea63dddd463158d1",
"versionType": "git"
},
{
"lessThan": "6a6d36fadb8537d9b79e72c9fa51885ec0c33e10",
"status": "affected",
"version": "11efd5cb04a184eea4f57b68ea63dddd463158d1",
"versionType": "git"
},
{
"lessThan": "403f96c32c9e24600093d7d0c61c17daeedca957",
"status": "affected",
"version": "11efd5cb04a184eea4f57b68ea63dddd463158d1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/openvswitch/conntrack.c",
"net/openvswitch/conntrack.h",
"net/openvswitch/datapath.c",
"net/openvswitch/datapath.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: Fix CT limit teardown use-after-free\n\nPacket processing uses CT limit state under RCU, while netns teardown\nfrees that state under ovs_mutex. The CT limit pointer was neither removed\nfrom readers nor protected by a grace period, allowing packet processing to\ndereference the freed state.\n\nAn unprivileged user can trigger this bug from a user and network\nnamespace, causing a slab-use-after-free in ovs_ct_execute() when the\nnetns is torn down.\n\nPublish the CT limit pointer through RCU, remove it before teardown, and\nwait for readers before freeing its contents. Keep ovs_mutex around\nindividual CT limit updates, and use the RCU read-side lock while GET\ntraverses the RCU-protected limit lists.\n\nNetns teardown detaches the RCU-protected CT limit state in the pernet\n.pre_exit callback while holding ovs_mutex. The pernet core guarantees an\nRCU grace period between the .pre_exit and .exit callbacks, so the .exit\ncallback completes the teardown without adding any extra synchronization.\n\nThe netlink command handlers do not need NULL checks because the userspace\nnetlink socket holds an active reference to its network namespace while a\nrequest is processed. The per-netns exit path therefore cannot run\nconcurrently with SET, DEL, or GET for that socket\u0027s namespace."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached from the OVS datapath CT commit path (ovs_ct_execute/ovs_ct_check_limit) while the attacker\u0027s netns is torn down. Setup uses local genetlink (datapath, CT flow, CT_LIMIT SET) and packet injection via a vport (veth/TUN/internal) or OVS_PACKET_CMD_EXECUTE; this is not a remotely triggered protocol parser.\nAC:L - The attacker controls both sides of the race: they enable CT limits, install a CT-commit flow, inject packets so ovs_ct_check_limit runs under RCU, and destroy the netns so ovs_ct_limit_exit kfree()s the same object without a grace period. Success does not depend on victim-only timing.\nPR:L - OVS genetlink families are netnsok and use GENL_UNS_ADMIN_PERM, so CAP_NET_ADMIN is checked in the socket\u0027s user namespace (unshare -Urn). The fix commit states an unprivileged user can trigger the slab-use-after-free from a user and network namespace.\nUI:N - Exploitation needs only the attacker\u0027s own netlink setup, packet injection, and netns teardown. No victim action such as mounting a filesystem, opening a file, or clicking a prompt is required.\nS:U - This is kernel slab use-after-free in the host Open vSwitch datapath. Impact stays in the same kernel security authority and is not a VM escape, IOMMU/DMA bypass, or other cross-boundary compromise.\nC:H - ovs_ct_check_limit/ct_limit_get dereference freed ovs_ct_limit_info and walk its kmalloc\u0027d limits hlist after ovs_ct_limit_exit kfree()s them, a slab UAF that can be reclaimed and used for arbitrary kernel reads.\nI:H - With a finite zone limit, nf_conncount_count_skb() inserts into nf_conncount_data after nf_conncount_destroy(); combined with UAF of the limits table this is a write-after-free/heap primitive that can be turned into arbitrary write or control-flow hijack.\nA:H - The commit reports a slab-use-after-free in ovs_ct_execute() on netns teardown. UAF of CT-limit and conncount objects can oops/panic the kernel even when not fully exploited for code execution."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:47:38.827Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/239f26589a6926db28c436e14f28517581ef1385"
},
{
"url": "https://git.kernel.org/stable/c/3b9369881b403f4cdbb11fa998554382bdcc3d8c"
},
{
"url": "https://git.kernel.org/stable/c/3b41d907400cc1dd1da9555b81dca422b1f44433"
},
{
"url": "https://git.kernel.org/stable/c/680f20d5937fa4d1367c59fe83091b78041015f5"
},
{
"url": "https://git.kernel.org/stable/c/bf4aaa7ea2579e24ed7de2e20578a875bebca011"
},
{
"url": "https://git.kernel.org/stable/c/e15407c3a8a005324f633cd46cd8fb58042c1157"
},
{
"url": "https://git.kernel.org/stable/c/6a6d36fadb8537d9b79e72c9fa51885ec0c33e10"
},
{
"url": "https://git.kernel.org/stable/c/403f96c32c9e24600093d7d0c61c17daeedca957"
}
],
"title": "openvswitch: Fix CT limit teardown use-after-free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89488",
"datePublished": "2026-09-11T19:43:41.471Z",
"dateReserved": "2026-09-11T19:38:34.713Z",
"dateUpdated": "2026-10-19T08:47:38.827Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93827 (GCVE-0-2026-93827)
Vulnerability from cvelistv5
Published
2026-09-24 16:03
Modified
2026-09-25 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
virtio-fs: avoid double-free on failed queue setup
virtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling
virtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both
pointers and returns an error to virtio_fs_probe().
virtio_fs_probe() then drops the last kobject reference, and
virtio_fs_ktype_release() frees fs->vqs and fs->mq_map again. This leaves
dangling pointers in struct virtio_fs and can trigger a double-free during
probe failure cleanup.
Set fs->vqs and fs->mq_map to NULL immediately after kfree() in the
virtio_fs_setup_vqs() error path so that the later kobject release sees an
uninitialized state and kfree(NULL) becomes harmless.
This can be reproduced when a broken virtio-fs device advertises more
request queues than the transport actually provides. In that case
virtio_find_vqs() fails while setting up the extra queue, and the probe
path reaches the double-free cleanup sequence.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/fuse/virtio_fs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3fbc5ee776fefbc6ea34d2518f1f5f90aa2e1dad",
"status": "affected",
"version": "a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9",
"versionType": "git"
},
{
"lessThan": "20ef4739b329bb09cff11dd2458795a50674658e",
"status": "affected",
"version": "a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9",
"versionType": "git"
},
{
"lessThan": "6af3330ec5d5fb8c06c04eb520a71cf73ea5a765",
"status": "affected",
"version": "a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/fuse/virtio_fs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-fs: avoid double-free on failed queue setup\n\nvirtio_fs_setup_vqs() allocates fs-\u003evqs and fs-\u003emq_map before calling\nvirtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both\npointers and returns an error to virtio_fs_probe().\n\nvirtio_fs_probe() then drops the last kobject reference, and\nvirtio_fs_ktype_release() frees fs-\u003evqs and fs-\u003emq_map again. This leaves\ndangling pointers in struct virtio_fs and can trigger a double-free during\nprobe failure cleanup.\n\nSet fs-\u003evqs and fs-\u003emq_map to NULL immediately after kfree() in the\nvirtio_fs_setup_vqs() error path so that the later kobject release sees an\nuninitialized state and kfree(NULL) becomes harmless.\n\nThis can be reproduced when a broken virtio-fs device advertises more\nrequest queues than the transport actually provides. In that case\nvirtio_find_vqs() fails while setting up the extra queue, and the probe\npath reaches the double-free cleanup sequence."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The triggering field is virtio_fs_config.num_request_queues, read by virtio_cread_le() in virtio_fs_setup_vqs() from virtio_fs_probe() via virtio_dev_probe() after virtio_pci_probe()/register_virtio_device() binds a VIRTIO_ID_FS device; those bytes come from local PCI/MMIO/vDPA config space, not a network protocol message.\nAC:L - A device that advertises more request queues than it exposes makes virtio_find_vqs()-\u003evp_setup_vq() fail (-EINVAL when index \u003e= vp_modern_get_num_queues(), or -ENOENT on queue size 0); virtio_fs_setup_vqs() then kfree\u0027s fs-\u003evqs and fs-\u003emq_map and virtio_fs_probe() always kobject_put()s into the second free, with no race.\nPR:N - virtio_fs_probe()/virtio_fs_setup_vqs() have no capable() or credential check; MODULE_DEVICE_TABLE(virtio, id_table) autoloads virtiofs and virtio_dev_probe() binds a VIRTIO_ID_FS device at enumeration or hotplug, so a malicious virtio-fs backend needs no account on the guest.\nUI:N - The double-free runs in the probe error path (virtio_fs_setup_vqs() failure, then kobject_put() into virtio_fs_ktype_release()) when the device appears; virtio_fs_add_instance() and a virtiofs mount are never reached, so no victim must mount or open anything.\nS:U - virtio_fs_ktype_release() double-frees the guest kernel kmalloc objects fs-\u003evqs and fs-\u003emq_map; that is device-to-guest heap corruption inside the same guest kernel, not a write into host virtiofsd or a KVM/IOMMU escape.\nC:H - kfree(fs-\u003evqs) and kfree(fs-\u003emq_map) in virtio_fs_setup_vqs() leave dangling pointers that virtio_fs_ktype_release() frees again; a slab double-free of that virtio_fs_vq array and per-CPU mq_map lets those objects overlap so the attacker can read adjacent kernel heap.\nI:H - The same second kfree of fs-\u003evqs and fs-\u003emq_map corrupts the SLUB freelist for those kmalloc objects and is an arbitrary-free primitive, enabling heap overwrite and control-flow hijack in the guest kernel.\nA:H - Double-free of fs-\u003evqs and fs-\u003emq_map in virtio_fs_ktype_release() after virtio_find_vqs() fails oopses or panics the guest during probe cleanup (KASAN invalid-free, SLUB poisoned-freelist BUG, or panic_on_oops)."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T12:43:36.887Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3fbc5ee776fefbc6ea34d2518f1f5f90aa2e1dad"
},
{
"url": "https://git.kernel.org/stable/c/20ef4739b329bb09cff11dd2458795a50674658e"
},
{
"url": "https://git.kernel.org/stable/c/6af3330ec5d5fb8c06c04eb520a71cf73ea5a765"
}
],
"title": "virtio-fs: avoid double-free on failed queue setup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93827",
"datePublished": "2026-09-24T16:03:05.795Z",
"dateReserved": "2026-09-18T17:59:28.792Z",
"dateUpdated": "2026-09-25T12:43:36.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46149 (GCVE-0-2026-46149)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-10-19 19:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a
256-byte stack buffer, then will memcpy() cur_len bytes from that
buffer. snprintf() returns the length the output would have had, which
can exceed the buffer size when the fabric WWN is long because iSCSI IQN
names can be up to 223 bytes. The check at the memcpy() site only
guards the destination page write, not the source read, so memcpy() will
read past the stack buffer and copy adjacent stack contents to the sysfs
reader, which when CONFIG_FORTIFY_SOURCE is enabled, fortify_panic()
will be triggered.
Commit 27e06650a5ea ("scsi: target: target_core_configfs: Add length
check to avoid buffer overflow") added the same bound to the
target_lu_gp_members_show() but the tg_pt_gp variant was missed so
resolve that here.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 Version: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 Version: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 Version: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 Version: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 Version: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 Version: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 Version: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:20:49.126Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46149",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:20:25.998388Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-126",
"description": "CWE-126 Buffer Over-read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:36:52.452Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_configfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d3cc9d490c207d57a289054397349f6f8c90354e",
"status": "affected",
"version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
"versionType": "git"
},
{
"lessThan": "db0a4759d62cad4ff891e2d81ae4be73bb57f4a4",
"status": "affected",
"version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
"versionType": "git"
},
{
"lessThan": "12f2201a56957ba020392223a7393a5eba080c1b",
"status": "affected",
"version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
"versionType": "git"
},
{
"lessThan": "1f678d13e939f91840cb1ebe9b88544923539d3c",
"status": "affected",
"version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
"versionType": "git"
},
{
"lessThan": "72cc5ea7ef32bb5fa38bf0dd2e56fcd73aa8c89e",
"status": "affected",
"version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
"versionType": "git"
},
{
"lessThan": "00d91bfdce5033f5d9b4915638ae9b0553848b5d",
"status": "affected",
"version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
"versionType": "git"
},
{
"lessThan": "e501154f9d82c95d2719bcbbaf679d8fd3226ef7",
"status": "affected",
"version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
"versionType": "git"
},
{
"lessThan": "772a896a56e0e3ef9424a025cec9176f9d8f4552",
"status": "affected",
"version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_configfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"lessThan": "2.6.38",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()\n\ntarget_tg_pt_gp_members_show() formats LUN paths with snprintf() into a\n256-byte stack buffer, then will memcpy() cur_len bytes from that\nbuffer. snprintf() returns the length the output would have had, which\ncan exceed the buffer size when the fabric WWN is long because iSCSI IQN\nnames can be up to 223 bytes. The check at the memcpy() site only\nguards the destination page write, not the source read, so memcpy() will\nread past the stack buffer and copy adjacent stack contents to the sysfs\nreader, which when CONFIG_FORTIFY_SOURCE is enabled, fortify_panic()\nwill be triggered.\n\nCommit 27e06650a5ea (\"scsi: target: target_core_configfs: Add length\ncheck to avoid buffer overflow\") added the same bound to the\ntarget_lu_gp_members_show() but the tg_pt_gp variant was missed so\nresolve that here."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is triggered by reading a configfs/sysfs attribute file (target/.../alua/tg_pt_gps/\u003cgrp\u003e/members); there is no network-reachable path and the formatted IQN comes from local admin config, so it requires local system access.\nAC:L - Given a target configured with a sufficiently long iSCSI IQN (the vulnerable configuration), simply reading the file deterministically triggers the out-of-bounds read/fortify_panic with no race or memory-layout dependency.\nPR:L - The members attribute is CONFIGFS_ATTR_RO (mode 0444, world-readable) with no capability check in the show path, so any unprivileged local user who can read the globally-mounted configfs file triggers it.\nUI:N - Exploitation is a single read() of the file with no victim/user interaction required.\nS:U - The impact (stack info leak / panic) stays within the kernel\u0027s own security authority with no crossing of a trust boundary such as a VM or IOMMU.\nC:H - The memcpy reads past the 256-byte stack buffer and copies adjacent kernel stack contents (potential pointers/canary) into the userspace-readable sysfs page, an out-of-bounds read disclosing kernel memory.\nI:N - The destination page write is bounded by the PAGE_SIZE check, so no kernel memory is modified; the bug is a read-only overflow providing no write primitive.\nA:H - With CONFIG_FORTIFY_SOURCE enabled, the over-read memcpy triggers fortify_panic(), causing a kernel panic (denial of service)."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:02.477Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d3cc9d490c207d57a289054397349f6f8c90354e"
},
{
"url": "https://git.kernel.org/stable/c/db0a4759d62cad4ff891e2d81ae4be73bb57f4a4"
},
{
"url": "https://git.kernel.org/stable/c/12f2201a56957ba020392223a7393a5eba080c1b"
},
{
"url": "https://git.kernel.org/stable/c/1f678d13e939f91840cb1ebe9b88544923539d3c"
},
{
"url": "https://git.kernel.org/stable/c/72cc5ea7ef32bb5fa38bf0dd2e56fcd73aa8c89e"
},
{
"url": "https://git.kernel.org/stable/c/00d91bfdce5033f5d9b4915638ae9b0553848b5d"
},
{
"url": "https://git.kernel.org/stable/c/e501154f9d82c95d2719bcbbaf679d8fd3226ef7"
},
{
"url": "https://git.kernel.org/stable/c/772a896a56e0e3ef9424a025cec9176f9d8f4552"
}
],
"title": "scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46149",
"datePublished": "2026-05-28T09:36:05.706Z",
"dateReserved": "2026-05-13T15:03:33.101Z",
"dateUpdated": "2026-10-19T19:36:52.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74582 (GCVE-0-2026-74582)
Vulnerability from cvelistv5
Published
2026-08-21 16:31
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
packet: use consistent hard_header_len in non-ring send paths
packet_snd() reads dev->hard_header_len multiple times while allocating
and constructing an skb. Device reconfiguration can change this value
concurrently, for example through bonding device type changes.
For SOCK_RAW, packet_snd() can save a larger value in reserve and later
allocate headroom using a smaller value. Moving skb->data back by reserve
then places it before skb->head, and the following copy from userspace can
attempt an out-of-bounds write.
packet_sendmsg_spkt() has the same issue because it calculates its
reservation and header offset from separate reads before dropping the RCU
read lock to allocate the skb.
Add LL_RESERVED_SPACE_EX() for callers that already saved a header length.
Read hard_header_len once in packet_snd() and use it for allocation and
construction. In packet_sendmsg_spkt(), preserve the allocation-time value
through the device lookup retry.
The separate SOCK_DGRAM consistency problem between hard_header_len and
header_ops->create is not addressed here.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba Version: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba Version: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba Version: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba Version: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba Version: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba Version: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba Version: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba Version: d9fb8cc230b2a4757e9fe4f81468f81212d4deaa Version: 6190cce26e40bf71c4d375b21eea74bb07b6a0f3 Version: 01a658c1b9d4b5393c38d5a92d9112ab1425382a Version: 8809ae6747e760e6f1d2453ceb08c9bcc4939766 Version: 4.4.133 ≤ Version: 4.9.103 ≤ Version: 4.14.44 ≤ Version: 4.16.12 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74582",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:01:14.406882Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:58.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/netdevice.h",
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "78a47127e33c340bc6d38dcc4552a094b4f5cc77",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "142e287b3a25cfe909215177c23243e7fc5ae2b1",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "91f041451f967cd87ed722a8f43c0b767a64f1a0",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "9052756290962ffb9a661bcf319e92dedaaedfed",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "5bb10753d428aadfc356a2bfe9acea09c82a62ec",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "b06b6fce6d7deaf7238e09b48ce3b1125ff41acd",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "03390aa32e669cc4ecd7d34108e2e1afc13d689d",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"status": "affected",
"version": "d9fb8cc230b2a4757e9fe4f81468f81212d4deaa",
"versionType": "git"
},
{
"status": "affected",
"version": "6190cce26e40bf71c4d375b21eea74bb07b6a0f3",
"versionType": "git"
},
{
"status": "affected",
"version": "01a658c1b9d4b5393c38d5a92d9112ab1425382a",
"versionType": "git"
},
{
"status": "affected",
"version": "8809ae6747e760e6f1d2453ceb08c9bcc4939766",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.133",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.103",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.44",
"versionType": "semver"
},
{
"lessThan": "4.17",
"status": "affected",
"version": "4.16.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/netdevice.h",
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.133",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.16.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in non-ring send paths\n\npacket_snd() reads dev-\u003ehard_header_len multiple times while allocating\nand constructing an skb. Device reconfiguration can change this value\nconcurrently, for example through bonding device type changes.\n\nFor SOCK_RAW, packet_snd() can save a larger value in reserve and later\nallocate headroom using a smaller value. Moving skb-\u003edata back by reserve\nthen places it before skb-\u003ehead, and the following copy from userspace can\nattempt an out-of-bounds write.\n\npacket_sendmsg_spkt() has the same issue because it calculates its\nreservation and header offset from separate reads before dropping the RCU\nread lock to allocate the skb.\n\nAdd LL_RESERVED_SPACE_EX() for callers that already saved a header length.\nRead hard_header_len once in packet_snd() and use it for allocation and\nconstruction. In packet_sendmsg_spkt(), preserve the allocation-time value\nthrough the device lookup retry.\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops-\u003ecreate is not addressed here."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is in packet_snd() and packet_sendmsg_spkt() on the local AF_PACKET sendmsg() transmit path; it is not triggered by processing remotely received network traffic or pre-authentication network services.\nAC:L - An attacker in a user+network namespace can open an AF_PACKET SOCK_RAW socket and concurrently reconfigure the bound netdev (bonding/VLAN/macvlan/team) to change hard_header_len, controlling both sides of the race without external timing.\nPR:L - Exploitation requires CAP_NET_RAW to create AF_PACKET sockets and CAP_NET_ADMIN to change netdev hard_header_len; both are obtainable by an unprivileged user inside a user namespace without init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug using their own packet socket sendmsg calls and concurrent netdev reconfiguration threads.\nS:U - Impact is kernel heap corruption and local privilege escalation within the same kernel security domain; it does not constitute a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:H - Racing hard_header_len can place skb-\u003edata before skb-\u003ehead, and skb_copy_datagram_from_iter/memcpy_from_msg then writes attacker-controlled data outside the skb buffer, corrupting adjacent slab objects and enabling kernel memory disclosure.\nI:H - Inconsistent hard_header_len between skb allocation and header adjustment causes out-of-bounds kernel heap writes of attacker-controlled packet data, yielding corruption primitives suitable for control-flow hijacking and local privilege escalation.\nA:H - Out-of-bounds skb buffer writes corrupt kmalloc metadata and can trigger kernel oops/panic, causing reliable denial of service even when full exploitation is not completed."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:39:47.499Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812"
},
{
"url": "https://git.kernel.org/stable/c/78a47127e33c340bc6d38dcc4552a094b4f5cc77"
},
{
"url": "https://git.kernel.org/stable/c/142e287b3a25cfe909215177c23243e7fc5ae2b1"
},
{
"url": "https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0"
},
{
"url": "https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed"
},
{
"url": "https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec"
},
{
"url": "https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd"
},
{
"url": "https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d"
}
],
"title": "packet: use consistent hard_header_len in non-ring send paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74582",
"datePublished": "2026-08-21T16:31:55.283Z",
"dateReserved": "2026-08-15T05:44:03.918Z",
"dateUpdated": "2026-10-16T19:05:58.230Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68398 (GCVE-0-2026-68398)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-19 21:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:
l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv()
-> ppp_input(&po->chan)
It runs under rcu_read_lock() holding only an l2tp_session reference and
takes NO reference on the internal PPP channel (struct channel,
chan->ppp) that ppp_input() dereferences.
The pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel
are RCU-safe. But the internal struct channel is a separate allocation
that ppp_release_channel() frees with a plain kfree():
close(data socket) -> pppol2tp_release() -> pppox_unbind_sock()
-> ppp_unregister_channel() -> ppp_release_channel() -> kfree(pch)
For a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit
(no PPPIOCCONNECT, pch->ppp == NULL) and not bridged, teardown skips
both ppp_disconnect_channel()'s synchronize_net() and
ppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace
period. rcu_read_lock() in pppol2tp_recv() does not protect against a
plain kfree(), so an in-flight ppp_input() on one CPU can dereference
the channel just freed by close() on another CPU.
The bug is reachable by an unprivileged user.
Defer the channel free to an RCU callback via call_rcu() so the grace
period fences any in-flight ppp_input(). The disconnect and unbridge
teardown paths already fence with synchronize_net()/synchronize_rcu();
call_rcu() does the same here without stalling the close() path.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 Version: ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 Version: ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 Version: ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 Version: ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 Version: ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 Version: ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 Version: d36e5ba7bbed5d7bd26e8609ffed503c2def401b Version: 9bcc0508576b2d50efd958f2ea1c5906749c2c89 Version: c2984681fe15cfb803a9132aaaf1140ab20a72c1 Version: 5803ecd7f6ac6f747582e775caa62ac9d0489261 Version: 26f8819ddd10141ebe7bbce700fbab36bfa5f478 Version: 3.2.99 ≤ Version: 3.16.54 ≤ Version: 4.4.225 ≤ Version: 4.9.225 ≤ Version: 4.14.182 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68398",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:48:09.975001Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:08.443Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/ppp_generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4e47f1ac188ece11d6fdabe44166a2776cc5bd4e",
"status": "affected",
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
"versionType": "git"
},
{
"lessThan": "110b765744b147c63882f5e9cb12931c5dc8d85f",
"status": "affected",
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
"versionType": "git"
},
{
"lessThan": "4bb84e964ff0fe0a171c965362de72f9820dbce9",
"status": "affected",
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
"versionType": "git"
},
{
"lessThan": "3ab32218d7182705dae5c86f13925f458072da2c",
"status": "affected",
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
"versionType": "git"
},
{
"lessThan": "c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa",
"status": "affected",
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
"versionType": "git"
},
{
"lessThan": "06213c85d8c0994f786c093b8b2a517987943ca6",
"status": "affected",
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
"versionType": "git"
},
{
"lessThan": "ec4215683e47424c9c4762fd3c60f552a3119142",
"status": "affected",
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
"versionType": "git"
},
{
"status": "affected",
"version": "d36e5ba7bbed5d7bd26e8609ffed503c2def401b",
"versionType": "git"
},
{
"status": "affected",
"version": "9bcc0508576b2d50efd958f2ea1c5906749c2c89",
"versionType": "git"
},
{
"status": "affected",
"version": "c2984681fe15cfb803a9132aaaf1140ab20a72c1",
"versionType": "git"
},
{
"status": "affected",
"version": "5803ecd7f6ac6f747582e775caa62ac9d0489261",
"versionType": "git"
},
{
"status": "affected",
"version": "26f8819ddd10141ebe7bbce700fbab36bfa5f478",
"versionType": "git"
},
{
"lessThan": "3.3",
"status": "affected",
"version": "3.2.99",
"versionType": "semver"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.54",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.225",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.225",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.182",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/ppp_generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.225",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.225",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.182",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF\n\npppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:\n\n l2tp_udp_encap_recv() -\u003e l2tp_recv_common() -\u003e pppol2tp_recv()\n -\u003e ppp_input(\u0026po-\u003echan)\n\nIt runs under rcu_read_lock() holding only an l2tp_session reference and\ntakes NO reference on the internal PPP channel (struct channel,\nchan-\u003eppp) that ppp_input() dereferences.\n\nThe pppox socket is SOCK_RCU_FREE, so \u0027po\u0027 and the embedded ppp_channel\nare RCU-safe. But the internal struct channel is a separate allocation\nthat ppp_release_channel() frees with a plain kfree():\n\n close(data socket) -\u003e pppol2tp_release() -\u003e pppox_unbind_sock()\n -\u003e ppp_unregister_channel() -\u003e ppp_release_channel() -\u003e kfree(pch)\n\nFor a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit\n(no PPPIOCCONNECT, pch-\u003eppp == NULL) and not bridged, teardown skips\nboth ppp_disconnect_channel()\u0027s synchronize_net() and\nppp_unbridge_channels()\u0027s synchronize_rcu(), so the kfree() has no grace\nperiod. rcu_read_lock() in pppol2tp_recv() does not protect against a\nplain kfree(), so an in-flight ppp_input() on one CPU can dereference\nthe channel just freed by close() on another CPU.\n\nThe bug is reachable by an unprivileged user.\n\nDefer the channel free to an RCU callback via call_rcu() so the grace\nperiod fences any in-flight ppp_input(). The disconnect and unbridge\nteardown paths already fence with synchronize_net()/synchronize_rcu();\ncall_rcu() does the same here without stalling the close() path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The free side of the race is a local close() of the pppol2tp socket, which no remote peer can invoke; the full attack (create tunnel/session via AF_PPPOX socket, drive RX with loopback UDP datagrams, close concurrently) is performed entirely through local syscalls.\nAC:L - The attacker controls both sides of the race, feeding the UDP-encap RX softirq from one thread while closing the pppox socket on another, and can retry the loop indefinitely until the window is hit.\nPR:L - No capability check exists on this path: pppox_create()/pppol2tp_connect() and ppp_register_net_channel() need no CAP_NET_ADMIN, and PPPIOCGCHAN is handled by pppox_ioctl() on the socket itself, so /dev/ppp access is not required; the fix commit states the bug is reachable by an unprivileged user.\nUI:N - The attacker performs every step \u2014 socket creation, session setup, packet injection and close() \u2014 with no action by any other user or administrator.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After the channel is freed and its slab object reallocated, ppp_input() reads pch-\u003ebridge and pch-\u003eppp from attacker-groomed memory and can route received frames to an arbitrary attacker-chosen structure, giving a path to disclosing kernel memory.\nI:H - skb_queue_tail(\u0026pch-\u003efile.rq, skb) writes a linked-list insertion into the freed object and wake_up_interruptible(\u0026pch-\u003efile.rwait) traverses a freed waitqueue, so heap grooming yields controlled writes and function-pointer traversal usable for privilege escalation.\nA:H - Dereferencing and writing to the kfree()d struct channel from softirq context reliably corrupts the slab and panics or oopses the kernel, and the race can be re-triggered at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:34:49.839Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4e47f1ac188ece11d6fdabe44166a2776cc5bd4e"
},
{
"url": "https://git.kernel.org/stable/c/110b765744b147c63882f5e9cb12931c5dc8d85f"
},
{
"url": "https://git.kernel.org/stable/c/4bb84e964ff0fe0a171c965362de72f9820dbce9"
},
{
"url": "https://git.kernel.org/stable/c/3ab32218d7182705dae5c86f13925f458072da2c"
},
{
"url": "https://git.kernel.org/stable/c/c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa"
},
{
"url": "https://git.kernel.org/stable/c/06213c85d8c0994f786c093b8b2a517987943ca6"
},
{
"url": "https://git.kernel.org/stable/c/ec4215683e47424c9c4762fd3c60f552a3119142"
}
],
"title": "ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68398",
"datePublished": "2026-08-10T12:04:17.771Z",
"dateReserved": "2026-07-30T09:28:09.389Z",
"dateUpdated": "2026-10-19T21:09:08.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98364 (GCVE-0-2026-98364)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: hold net_device reference under RCU in bundle creation
xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into
a local pointer without taking a device reference, then pass it to
xfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst->dev via
dst_dev_put() and frees the old net_device, causing a use-after-free
when xfrm6_fill_dst() later dereferences the stale dev pointer.
BUG: KASAN: slab-use-after-free in xfrm6_fill_dst+0x82c/0x860
(net/ipv6/xfrm6_policy.c:86 netdev_hold())
Read of size 8 at addr ffff8880142fe588 by task exploit/153
Call Trace:
xfrm6_fill_dst+0x82c/0x860
xfrm_resolve_and_create_bundle+0x21d4/0x2bd0
xfrm_lookup_with_ifid+0x485/0x1640
ip6_dst_lookup_flow+0x19b/0x1e0
udpv6_sendmsg+0x1443/0x2dd0
Fix this by reading dst->dev via dst_dev_rcu() and keeping the RCU
read-side critical section active until xfrm_fill_dst() has taken the
required device references.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8d85d6bc9c46dc41cb2be0eac53f8ab068c3a807",
"status": "affected",
"version": "25ee3286dcbc830a833354bb1d15567956844813",
"versionType": "git"
},
{
"lessThan": "9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1",
"status": "affected",
"version": "25ee3286dcbc830a833354bb1d15567956844813",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: hold net_device reference under RCU in bundle creation\n\nxfrm_bundle_create() and xfrm_create_dummy_bundle() read dst-\u003edev into\na local pointer without taking a device reference, then pass it to\nxfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst-\u003edev via\ndst_dev_put() and frees the old net_device, causing a use-after-free\nwhen xfrm6_fill_dst() later dereferences the stale dev pointer.\n\n BUG: KASAN: slab-use-after-free in xfrm6_fill_dst+0x82c/0x860\n (net/ipv6/xfrm6_policy.c:86 netdev_hold())\n Read of size 8 at addr ffff8880142fe588 by task exploit/153\n Call Trace:\n xfrm6_fill_dst+0x82c/0x860\n xfrm_resolve_and_create_bundle+0x21d4/0x2bd0\n xfrm_lookup_with_ifid+0x485/0x1640\n ip6_dst_lookup_flow+0x19b/0x1e0\n udpv6_sendmsg+0x1443/0x2dd0\n\nFix this by reading dst-\u003edev via dst_dev_rcu() and keeping the RCU\nread-side critical section active until xfrm_fill_dst() has taken the\nrequired device references."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Both sides of the race are local syscalls: sendmsg() (udpv6_sendmsg-\u003eip6_dst_lookup_flow-\u003exfrm_lookup_with_ifid-\u003exfrm_bundle_create) and an RTM_DELLINK rtnetlink request that frees the net_device. A remote peer cannot delete the link, so the network cannot cause the freed state.\nAC:L - The attacker controls both sides of the race: they repeatedly send through an xfrm-policy-matched route while deleting the link in a loop. The window between reading dst-\u003edev and netdev_hold() in xfrm_fill_dst() is short, but the attacker can retry as often as needed.\nPR:L - xfrm_user_rcv_msg only checks netlink_net_capable(CAP_NET_ADMIN), and RTM_DELLINK is also checked per namespace. An unprivileged user with unshare -Urn can create a device, install the XFRM policy and state, and delete the device inside their own network namespace.\nUI:N - No victim action is needed: the attacker sets up the namespace, the xfrm configuration, the sending socket and the link deletion entirely on their own.\nS:U - The use-after-free is inside the kernel\u0027s own networking code and the impact stays within the kernel\u0027s security authority; no VM or IOMMU boundary is crossed.\nC:H - xfrm6_fill_dst() reads dev-\u003eip6_ptr from the freed net_device through in6_dev_get() and stores the stale dev in a new dst. A reclaimed object controls those values, which can be used to disclose kernel memory.\nI:H - netdev_hold() increments a refcount inside the freed net_device, and in6_dev_get() increments a refcount on a pointer taken from the reclaimed object. Both are writes into attacker-reclaimable slab memory, usable to corrupt kernel data and hijack control flow.\nA:H - KASAN reports a slab-use-after-free in xfrm6_fill_dst(). On production kernels the stale dev stays attached to the new xfrm dst and is dereferenced later, which leads to an oops or panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:16.366Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8d85d6bc9c46dc41cb2be0eac53f8ab068c3a807"
},
{
"url": "https://git.kernel.org/stable/c/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1"
}
],
"title": "xfrm: hold net_device reference under RCU in bundle creation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98364",
"datePublished": "2026-10-06T08:46:50.051Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-19T09:18:16.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64191 (GCVE-0-2026-64191)
Vulnerability from cvelistv5
Published
2026-07-20 16:27
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i2c: stub: Reject I2C block transfers with invalid length
The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0]
as the transfer length. The existing check only clamps it to avoid
overrunning the chip->words[256] register array, but does not validate
it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union
i2c_smbus_data.block buffer (34 bytes total). The driver is a
development/test tool (CONFIG_I2C_STUB=m, not built by default)
that must be loaded with a chip_addr= parameter.
A local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl
with I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing
stub_xfer() to read or write past the end of the union
i2c_smbus_data.block buffer:
BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)
Read of size 1 at addr ffff88800abcfd92 by task exploit/81
Call Trace:
<TASK>
stub_xfer (drivers/i2c/i2c-stub.c:223)
__i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)
i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)
i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)
i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)
__x64_sys_ioctl (fs/ioctl.c:583)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
</TASK>
The bug exists because i2c-stub implements .smbus_xfer directly,
bypassing the I2C_SMBUS_BLOCK_MAX validation in
i2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same
function correctly validates against I2C_SMBUS_BLOCK_MAX, but the
I2C_SMBUS_I2C_BLOCK_DATA case does not.
Fix by rejecting transfers with data->block[0] == 0 or
data->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with
both the I2C_SMBUS_BLOCK_DATA case in the same function and the
I2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4710317891e4824ce1510a6b5066abbd3e917750 Version: 4710317891e4824ce1510a6b5066abbd3e917750 Version: 4710317891e4824ce1510a6b5066abbd3e917750 Version: 4710317891e4824ce1510a6b5066abbd3e917750 Version: 4710317891e4824ce1510a6b5066abbd3e917750 Version: 4710317891e4824ce1510a6b5066abbd3e917750 Version: 4710317891e4824ce1510a6b5066abbd3e917750 Version: 4710317891e4824ce1510a6b5066abbd3e917750 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64191",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:37:24.187565Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:15.069Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i2c/i2c-stub.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7e9072dbd5f2f17934751873450d2c22080ead80",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "21e87f336ac6303fed54a69b1d0d79a23b25c8d0",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "3fd225f3e4cd67ec8ddab1afed9da03c7c43537c",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "1c4ffe6b4f04365485ed58d64c9bb86b46fc9037",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "4bd8635f28c135a08aac6badcd7d9b5cdb34335f",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "5f4d2bd028ebb6e4c09a9d64842546022321d4a7",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "0526931b16e5a118d367b7bfce7d797e63f7ac69",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i2c/i2c-stub.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.33"
},
{
"lessThan": "2.6.33",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.14",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: stub: Reject I2C block transfers with invalid length\n\nThe I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data-\u003eblock[0]\nas the transfer length. The existing check only clamps it to avoid\noverrunning the chip-\u003ewords[256] register array, but does not validate\nit against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union\ni2c_smbus_data.block buffer (34 bytes total). The driver is a\ndevelopment/test tool (CONFIG_I2C_STUB=m, not built by default)\nthat must be loaded with a chip_addr= parameter.\n\nA local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl\nwith I2C_SMBUS_I2C_BLOCK_DATA and data-\u003eblock[0] \u003e 32, causing\nstub_xfer() to read or write past the end of the union\ni2c_smbus_data.block buffer:\n\n BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)\n Read of size 1 at addr ffff88800abcfd92 by task exploit/81\n Call Trace:\n \u003cTASK\u003e\n stub_xfer (drivers/i2c/i2c-stub.c:223)\n __i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)\n i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)\n i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)\n i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)\n __x64_sys_ioctl (fs/ioctl.c:583)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n \u003c/TASK\u003e\n\nThe bug exists because i2c-stub implements .smbus_xfer directly,\nbypassing the I2C_SMBUS_BLOCK_MAX validation in\ni2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same\nfunction correctly validates against I2C_SMBUS_BLOCK_MAX, but the\nI2C_SMBUS_I2C_BLOCK_DATA case does not.\n\nFix by rejecting transfers with data-\u003eblock[0] == 0 or\ndata-\u003eblock[0] \u003e I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with\nboth the I2C_SMBUS_BLOCK_DATA case in the same function and the\nI2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached by a local process issuing I2C_SMBUS ioctls on an i2c-stub /dev/i2c-* character device; it is neither remotely nor physically reachable.\nAC:L - Once i2c-stub is loaded, the attacker controls the address, direction, length, and register contents, making the corruption deterministic without a race. The non-default module configuration defines the vulnerable deployment rather than complicating exploitation within it.\nPR:L - The attacker needs unprivileged local access to the applicable /dev/i2c-* node, but no capability or namespace-specific administrative privilege is checked anywhere along the ioctl path.\nUI:N - After the vulnerable adapter is configured, exploitation requires only attacker-issued ioctls and no action by another user.\nS:U - The corruption occurs within the host kernel and represents conventional local privilege escalation, without crossing a separate virtualization or hardware security authority.\nC:H - An oversized block write reads up to 222 bytes beyond the 34-byte stack union and persists those bytes in attacker-readable stub registers, enabling substantial kernel-stack disclosure.\nI:H - An oversized block read writes up to 222 attacker-chosen bytes beyond the stack union because the attacker can prepopulate the stub registers, enabling control-data corruption and potential kernel code execution.\nA:H - The controlled stack overwrite can corrupt stack canaries, return state, or other control data, causing a repeatable kernel oops or panic even when code execution is unsuccessful."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:39:59.861Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7e9072dbd5f2f17934751873450d2c22080ead80"
},
{
"url": "https://git.kernel.org/stable/c/21e87f336ac6303fed54a69b1d0d79a23b25c8d0"
},
{
"url": "https://git.kernel.org/stable/c/3fd225f3e4cd67ec8ddab1afed9da03c7c43537c"
},
{
"url": "https://git.kernel.org/stable/c/1c4ffe6b4f04365485ed58d64c9bb86b46fc9037"
},
{
"url": "https://git.kernel.org/stable/c/4bd8635f28c135a08aac6badcd7d9b5cdb34335f"
},
{
"url": "https://git.kernel.org/stable/c/5f4d2bd028ebb6e4c09a9d64842546022321d4a7"
},
{
"url": "https://git.kernel.org/stable/c/0526931b16e5a118d367b7bfce7d797e63f7ac69"
},
{
"url": "https://git.kernel.org/stable/c/6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e"
}
],
"title": "i2c: stub: Reject I2C block transfers with invalid length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64191",
"datePublished": "2026-07-20T16:27:51.120Z",
"dateReserved": "2026-07-19T07:54:57.040Z",
"dateUpdated": "2026-10-19T20:28:15.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74641 (GCVE-0-2026-74641)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-10-16 19:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usx2y: bound the hwdep mmap fault offset
snd_us428ctls_vm_fault() turns the faulting page offset into a kernel
address with no bound of any kind:
offset = vmf->pgoff << PAGE_SHIFT;
vaddr = (char *)(...)->us428ctls_sharedmem + offset;
page = virt_to_page(vaddr);
get_page(page);
vmf->page = page;
return 0;
snd_us428ctls_mmap() checks only the length of the mapping, never the
offset, and us428ctls_sharedmem is a single page from
alloc_pages_exact(). For a character device file_mmap_size_max()
returns ULONG_MAX, so the mm layer imposes no ceiling either. Every page
offset above zero resolves to a struct page outside the object, and the
handler installs it into the caller's address space read-write; the vma
is not marked read-only.
The caller picks the page frame with a single mmap() argument and gets
read-write access to a page of kernel memory it does not own; an offset
that lands in an unpopulated vmemmap region oopses instead.
A process that can open the hwdep node of an attached US-X2Y reaches
this after loading the FPGA image through the same node; no capability
check is involved.
On 7.2.0-rc5 (arm64), mmap() with a large offset:
Unable to handle kernel paging request at virtual address fffffdffc45d5ac8
pc : snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y]
Call trace:
snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y]
__do_fault
__handle_mm_fault
handle_mm_fault
el0_da
Reject any offset outside the shared region. The pcm hwdep handler in
usx2yhwdeppcm.c computes its address the same way and needs the same
bound.
Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74641",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:03:36.280661Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:06:04.565Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/usx2y/usX2Yhwdep.c",
"sound/usb/usx2y/usx2yhwdeppcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ad6fedea65c6e90eda00d716c8bf20cdc437ed10",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "10a87401fb3148c388e55df0148295b3b137da07",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "34ab56ed854baa73a731cfd99af689f0b1bac444",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4208db2453e1ea71b8048a5b7802360cb29a53f1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f613b4a2d87247b51a1b2b330f2e083a454125f2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f75d6f61f0d9c5c1ea725104014e10d26d1e3a00",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5bf5ccddf00b59f1e3ea7e65d76a5f5b5c21cc2e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2ca1eea3cd17930daffe9e429a7c89232036ec24",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/usx2y/usX2Yhwdep.c",
"sound/usb/usx2y/usx2yhwdeppcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usx2y: bound the hwdep mmap fault offset\n\nsnd_us428ctls_vm_fault() turns the faulting page offset into a kernel\naddress with no bound of any kind:\n\n\toffset = vmf-\u003epgoff \u003c\u003c PAGE_SHIFT;\n\tvaddr = (char *)(...)-\u003eus428ctls_sharedmem + offset;\n\tpage = virt_to_page(vaddr);\n\tget_page(page);\n\tvmf-\u003epage = page;\n\n\treturn 0;\n\nsnd_us428ctls_mmap() checks only the length of the mapping, never the\noffset, and us428ctls_sharedmem is a single page from\nalloc_pages_exact(). For a character device file_mmap_size_max()\nreturns ULONG_MAX, so the mm layer imposes no ceiling either. Every page\noffset above zero resolves to a struct page outside the object, and the\nhandler installs it into the caller\u0027s address space read-write; the vma\nis not marked read-only.\n\nThe caller picks the page frame with a single mmap() argument and gets\nread-write access to a page of kernel memory it does not own; an offset\nthat lands in an unpopulated vmemmap region oopses instead.\n\nA process that can open the hwdep node of an attached US-X2Y reaches\nthis after loading the FPGA image through the same node; no capability\ncheck is involved.\n\nOn 7.2.0-rc5 (arm64), mmap() with a large offset:\n\n Unable to handle kernel paging request at virtual address fffffdffc45d5ac8\n pc : snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y]\n Call trace:\n snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y]\n __do_fault\n __handle_mm_fault\n handle_mm_fault\n el0_da\n\nReject any offset outside the shared region. The pcm hwdep handler in\nusx2yhwdeppcm.c computes its address the same way and needs the same\nbound.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local mmap() on the ALSA hwdep character device (/dev/snd/hwC*D*); the path is open\u2192SNDRV_HWDEP_IOCTL_DSP_LOAD\u2192mmap\u2192snd_us428ctls_vm_fault, with no network or remote packet handler involved.\nAC:L - The attacker fully controls the mmap() page offset (vmf-\u003epgoff); any offset beyond the single-page shared buffer deterministically maps an attacker-chosen kernel page read-write or oopses, with no race or uncontrollable memory-layout dependency.\nPR:L - The driver performs no capability checks on hwdep open, ioctl, or mmap; any unprivileged local user who can access the hwdep node (typically via the audio group on desktop distros) can reach the fault handler after loading the FPGA image.\nUI:N - All exploitation steps\u2014opening the hwdep node, loading FPGA firmware via DSP_LOAD ioctl, and mmap with a crafted offset\u2014are performed by the attacker; no discretionary victim action beyond the device being present in the environment is required.\nS:U - Impact is arbitrary read/write of host kernel memory leading to local privilege escalation within the same kernel security authority; it does not cross a VM, container, or IOMMU security boundary.\nC:H - Unbounded pgoff arithmetic maps arbitrary kernel struct pages into the attacker\u0027s address space; the VMA is not read-only, giving attacker-controlled read access to any reachable kernel page selected via the mmap offset.\nI:H - The same unbounded mmap fault path installs attacker-chosen kernel pages into a read-write userspace mapping, enabling arbitrary kernel memory writes and heap corruption primitives suitable for privilege escalation or code execution.\nA:H - Large mmap offsets dereference unpopulated vmemmap regions causing kernel paging faults and oops (demonstrated on arm64); arbitrary kernel page writes can also panic the system or destabilize the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:03.118Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ad6fedea65c6e90eda00d716c8bf20cdc437ed10"
},
{
"url": "https://git.kernel.org/stable/c/10a87401fb3148c388e55df0148295b3b137da07"
},
{
"url": "https://git.kernel.org/stable/c/34ab56ed854baa73a731cfd99af689f0b1bac444"
},
{
"url": "https://git.kernel.org/stable/c/4208db2453e1ea71b8048a5b7802360cb29a53f1"
},
{
"url": "https://git.kernel.org/stable/c/f613b4a2d87247b51a1b2b330f2e083a454125f2"
},
{
"url": "https://git.kernel.org/stable/c/f75d6f61f0d9c5c1ea725104014e10d26d1e3a00"
},
{
"url": "https://git.kernel.org/stable/c/5bf5ccddf00b59f1e3ea7e65d76a5f5b5c21cc2e"
},
{
"url": "https://git.kernel.org/stable/c/2ca1eea3cd17930daffe9e429a7c89232036ec24"
}
],
"title": "ALSA: usx2y: bound the hwdep mmap fault offset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74641",
"datePublished": "2026-08-22T15:32:19.696Z",
"dateReserved": "2026-08-15T05:44:03.922Z",
"dateUpdated": "2026-10-16T19:06:04.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53228 (GCVE-0-2026-53228)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-10-19 19:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: sit: reload inner IPv6 header after GSO offloads
ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function
entry and continues using it after iptunnel_handle_offloads().
For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone().
When the skb header is cloned, skb_header_unclone() can call
pskb_expand_head(), which may move the skb head. The pskb_expand_head()
contract requires pointers into the skb header to be reloaded after the
call.
If the later skb_realloc_headroom() branch is not taken, SIT uses the
stale iph6 pointer to read the inner hop limit and DS field. That can
read from a freed skb head after the old head's remaining clone is
released.
Reload iph6 after the offload helper succeeds and before subsequent
reads from the inner IPv6 header. Keep the existing reload after
skb_realloc_headroom(), since that branch can also replace the skb.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 14909664e4e192f4c6f6fcdccd9919af7cf783ab Version: 14909664e4e192f4c6f6fcdccd9919af7cf783ab Version: 14909664e4e192f4c6f6fcdccd9919af7cf783ab Version: 14909664e4e192f4c6f6fcdccd9919af7cf783ab Version: 14909664e4e192f4c6f6fcdccd9919af7cf783ab Version: 14909664e4e192f4c6f6fcdccd9919af7cf783ab Version: 14909664e4e192f4c6f6fcdccd9919af7cf783ab Version: 14909664e4e192f4c6f6fcdccd9919af7cf783ab |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:22:51.790Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53228",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:27:17.714387Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:57:30.192Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/sit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fddd41445a0537b093e6b3f6232c9933cad1e48b",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "1132e5edc2866c3530be17622153a597095f0e43",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "9c67b44edb3598d234efae6e44649eb993c03da5",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "0bfa7bba1f41aaf5f0604dc712bb4701493e3aa0",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "59f80c919713250fe5d25a4d9aea4e49580fa1d4",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "2fa49b2715e1bad12ce3b0fa64e234d9582c8193",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "cb658c2f5f7977c2a1c77c9f239f4bc8196edb5c",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "f0e42f0c4337b1f220de1ddd63f47197c7dee4de",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/sit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sit: reload inner IPv6 header after GSO offloads\n\nipip6_tunnel_xmit() caches the inner IPv6 header pointer at function\nentry and continues using it after iptunnel_handle_offloads().\n\nFor GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone().\nWhen the skb header is cloned, skb_header_unclone() can call\npskb_expand_head(), which may move the skb head. The pskb_expand_head()\ncontract requires pointers into the skb header to be reloaded after the\ncall.\n\nIf the later skb_realloc_headroom() branch is not taken, SIT uses the\nstale iph6 pointer to read the inner hop limit and DS field. That can\nread from a freed skb head after the old head\u0027s remaining clone is\nreleased.\n\nReload iph6 after the offload helper succeeds and before subsequent\nreads from the inner IPv6 header. Keep the existing reload after\nskb_realloc_headroom(), since that branch can also replace the skb."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable SIT transmit path can be reached by network-triggered IPv6 traffic in a reasonable deployment where a public service or router sends large TCP/GSO packets through a configured SIT tunnel.\nAC:L - There is no race or fragile timing requirement; GSO and header-cloned TCP skbs are normal for large TCP transmissions, and the attacker can repeatedly trigger them with network traffic.\nPR:N - In the network-triggered scenario, the attacker does not need local privileges or authentication; the required SIT configuration is an environmental precondition on the victim.\nUI:N - No victim user action is required beyond the system processing network traffic through the configured SIT tunnel.\nS:U - The impact remains within the kernel and its networking security authority, with no VM, IOMMU, or separate security-scope boundary crossed.\nC:H - The stale inner IPv6 header pointer can read from freed skb head memory after `skb_header_unclone()`/`pskb_expand_head()`, making this a kernel use-after-free read. Per kernel CVSS guidance, use-after-free conditions are scored with high confidentiality impact.\nI:H - Although the immediate stale access feeds header fields, it is a kernel use-after-free in attacker-triggerable networking memory, and kernel UAFs are treated as potentially exploitable for heap manipulation and integrity compromise.\nA:H - Use-after-free in the kernel networking transmit path can lead to oops, panic, or repeated crash conditions, especially under memory debugging or unfavorable heap reuse."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:20.273Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fddd41445a0537b093e6b3f6232c9933cad1e48b"
},
{
"url": "https://git.kernel.org/stable/c/1132e5edc2866c3530be17622153a597095f0e43"
},
{
"url": "https://git.kernel.org/stable/c/9c67b44edb3598d234efae6e44649eb993c03da5"
},
{
"url": "https://git.kernel.org/stable/c/0bfa7bba1f41aaf5f0604dc712bb4701493e3aa0"
},
{
"url": "https://git.kernel.org/stable/c/59f80c919713250fe5d25a4d9aea4e49580fa1d4"
},
{
"url": "https://git.kernel.org/stable/c/2fa49b2715e1bad12ce3b0fa64e234d9582c8193"
},
{
"url": "https://git.kernel.org/stable/c/cb658c2f5f7977c2a1c77c9f239f4bc8196edb5c"
},
{
"url": "https://git.kernel.org/stable/c/f0e42f0c4337b1f220de1ddd63f47197c7dee4de"
}
],
"title": "ipv6: sit: reload inner IPv6 header after GSO offloads",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53228",
"datePublished": "2026-06-25T08:39:27.893Z",
"dateReserved": "2026-06-09T07:44:35.393Z",
"dateUpdated": "2026-10-19T19:57:30.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63922 (GCVE-0-2026-63922)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-10-19 20:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: exthdrs: refresh nh after handling HAO option
ip6_parse_tlv() caches skb_network_header(skb) in nh while walking
IPv6 TLVs.
ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can
move the skb head and invalidate the cached network header pointer.
Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs
are parsed from the current skb head.
This matches the existing pattern used in ip6_parse_tlv() after helpers
that can modify skb header storage.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a831f5bbc89a9978795504be9e1ff412043f8f77 Version: a831f5bbc89a9978795504be9e1ff412043f8f77 Version: a831f5bbc89a9978795504be9e1ff412043f8f77 Version: a831f5bbc89a9978795504be9e1ff412043f8f77 Version: a831f5bbc89a9978795504be9e1ff412043f8f77 Version: a831f5bbc89a9978795504be9e1ff412043f8f77 Version: a831f5bbc89a9978795504be9e1ff412043f8f77 Version: a831f5bbc89a9978795504be9e1ff412043f8f77 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63922",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:33:28.158927Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:56.594Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/exthdrs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b3ac54e5c905f86d22b502eacb5686a282c5659f",
"status": "affected",
"version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
"versionType": "git"
},
{
"lessThan": "f8aabed3ff3e986920cf02a2a2785e08e586b234",
"status": "affected",
"version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
"versionType": "git"
},
{
"lessThan": "1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1",
"status": "affected",
"version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
"versionType": "git"
},
{
"lessThan": "12d957979e4a800167842f1b42be6a606d227ebe",
"status": "affected",
"version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
"versionType": "git"
},
{
"lessThan": "ff375ed1cba81392346c5bfbf0bb7a13b2946f99",
"status": "affected",
"version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
"versionType": "git"
},
{
"lessThan": "751db1b802a067b7fff25880f4e9f9152a171538",
"status": "affected",
"version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
"versionType": "git"
},
{
"lessThan": "9b6dcc0a39fd71752937f0b6b3973e1416085dcf",
"status": "affected",
"version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
"versionType": "git"
},
{
"lessThan": "f7b52afe3592eae66e160586b45a3f2242972c63",
"status": "affected",
"version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/exthdrs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.19"
},
{
"lessThan": "2.6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: exthdrs: refresh nh after handling HAO option\n\nip6_parse_tlv() caches skb_network_header(skb) in nh while walking\nIPv6 TLVs.\n\nipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can\nmove the skb head and invalidate the cached network header pointer.\nRefresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs\nare parsed from the current skb head.\n\nThis matches the existing pattern used in ip6_parse_tlv() after helpers\nthat can modify skb header storage."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached on the standard IPv6 input path (ipv6_rcv \u2192 ip6_input \u2192 ip6_protocol_deliver_rcu \u2192 ipv6_destopt_rcv) when a remotely sent IPv6 packet carries a Destination Options header processed by ip6_parse_tlv().\nAC:L - The attacker fully controls the crafted IPv6 Destination Options layout (HAO TLV followed by trailing TLVs/padding); once CONFIG_IPV6_MIP6 and matching XFRM state exist on the target, triggering the stale-pointer condition is a reliable single-packet attack without races or victim-specific timing.\nPR:N - No local privileges or authentication are required; any remote host that can deliver IPv6 traffic to a listening interface can reach this pre-authentication receive-path parser (destopt_protocol uses INET6_PROTO_NOPOLICY).\nUI:N - Exploitation requires only sending a malicious IPv6 packet; no victim interaction such as opening files, clicking links, or mounting filesystems is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the kernel\u2019s security authority; it does not cross VM, container, or IOMMU boundaries.\nC:H - After pskb_expand_head() frees the old skb head, ip6_parse_tlv() continues parsing trailing TLVs through the stale nh pointer, causing out-of-bounds/use-after-free reads of kernel heap memory that can disclose sensitive kernel data.\nI:H - Use-after-free of the skb head buffer during TLV parsing is heap memory corruption that can be leveraged for arbitrary kernel writes and control-flow hijacking, not merely a bounded parse error.\nA:H - Reading through the stale network-header pointer into freed or invalid memory can cause kernel oops/panic or unrecoverable instability, satisfying high availability impact even before full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:16.967Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f"
},
{
"url": "https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234"
},
{
"url": "https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1"
},
{
"url": "https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe"
},
{
"url": "https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99"
},
{
"url": "https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538"
},
{
"url": "https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf"
},
{
"url": "https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63"
}
],
"title": "ipv6: exthdrs: refresh nh after handling HAO option",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63922",
"datePublished": "2026-07-19T14:55:24.268Z",
"dateReserved": "2026-07-19T07:54:57.021Z",
"dateUpdated": "2026-10-19T20:17:56.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63920 (GCVE-0-2026-63920)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-10-19 20:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: validate extension header length before copying to cmsg
ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR}
cmsgs (and their IPV6_2292* legacy counterparts) by trusting the
on-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length.
The length was validated only at parse time (ipv6_parse_hopopts(),
etc.). An nftables payload-write expression can rewrite hdrlen after
parsing and before the skb reaches recvmsg; the write itself is
in-bounds but put_cmsg() then reads up to ((hdrlen+1) << 3) = 2040
bytes from an 8-byte header. nftables is reachable from an
unprivileged user namespace, so this is an unprivileged
slab-out-of-bounds read:
BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac/0x540
put_cmsg+0x3ac/0x540
udpv6_recvmsg+0xca0/0x1250
sock_recvmsg+0xdf/0x190
____sys_recvmsg+0x1b1/0x620
Add ipv6_get_exthdr_len() which validates that at least two bytes
are accessible before reading the hdrlen field, then checks the
computed length against skb_tail_pointer(skb), returning 0 on
failure. Extension headers are kept in the linear skb area by
pskb_may_pull() during input, so skb_tail_pointer() is the correct
bound.
Use ipv6_get_exthdr_len() at all non-AH call sites: the five
standalone cmsg blocks (HbH, 2292HbH, 2292DSTOPTS x2, 2292RTHDR)
and the three standard cases in the extension-header walk loop
(DSTOPTS, ROUTING, default). AH retains an inline bounds check
because its length formula differs ((ptr[1]+2)<<2).
The walk loop also gets a pre-read bounds check at the top to
validate ptr before any case accesses ptr[0] or ptr[1].
When the walk loop detects a corrupted header, return from the
function instead of continuing to process later socket options.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63920",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:33:23.448048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:56.265Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/datagram.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "81394827dfb72772c50d0ae3bdfa094428a5d76d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "931b4a1f13408c2507719890f78f7227c34a0282",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "08464413e628803bd10cb1df68d0138665f2f885",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a29768d56eb3798c052ad3281b05596e695a17af",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0d330eff318c0f44d4fb0ad2c2aef38f87f24c90",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a35daeabb433686234b010ebf7b53778dbd6c9b8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "eb18a1b1644e4cad978df2131e2bb9a2e6886992",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "dd433671fef381fdaf7b530c631e6b782d66e224",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/datagram.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: validate extension header length before copying to cmsg\n\nip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR}\ncmsgs (and their IPV6_2292* legacy counterparts) by trusting the\non-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length.\nThe length was validated only at parse time (ipv6_parse_hopopts(),\netc.). An nftables payload-write expression can rewrite hdrlen after\nparsing and before the skb reaches recvmsg; the write itself is\nin-bounds but put_cmsg() then reads up to ((hdrlen+1) \u003c\u003c 3) = 2040\nbytes from an 8-byte header. nftables is reachable from an\nunprivileged user namespace, so this is an unprivileged\nslab-out-of-bounds read:\n\n BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac/0x540\n put_cmsg+0x3ac/0x540\n udpv6_recvmsg+0xca0/0x1250\n sock_recvmsg+0xdf/0x190\n ____sys_recvmsg+0x1b1/0x620\n\nAdd ipv6_get_exthdr_len() which validates that at least two bytes\nare accessible before reading the hdrlen field, then checks the\ncomputed length against skb_tail_pointer(skb), returning 0 on\nfailure. Extension headers are kept in the linear skb area by\npskb_may_pull() during input, so skb_tail_pointer() is the correct\nbound.\n\nUse ipv6_get_exthdr_len() at all non-AH call sites: the five\nstandalone cmsg blocks (HbH, 2292HbH, 2292DSTOPTS x2, 2292RTHDR)\nand the three standard cases in the extension-header walk loop\n(DSTOPTS, ROUTING, default). AH retains an inline bounds check\nbecause its length formula differs ((ptr[1]+2)\u003c\u003c2).\n\nThe walk loop also gets a pre-read bounds check at the top to\nvalidate ptr before any case accesses ptr[0] or ptr[1].\n\nWhen the walk loop detects a corrupted header, return from the\nfunction instead of continuing to process later socket options."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local syscalls (nftables netlink to install a payload-set rule, setsockopt for IPV6_RECV* options, and recvmsg). Although the trigger packet is received over IPv6, the mandatory nftables corruption step is classified as Local per kernel guidance.\nAC:L - The attacker fully controls the nftables payload-set rule, the on-wire extension header, socket receive options, and the recvmsg call, making the slab out-of-bounds read reliably reproducible without races or external conditions.\nPR:L - An unprivileged local user can create a user+network namespace, obtain CAP_NET_ADMIN there, configure nftables, open a UDPv6/raw socket with extension-header cmsg options, and trigger the bug without real root in the initial namespace.\nUI:N - No victim interaction is required; the attacker can send the crafted IPv6 datagram and call recvmsg on their own socket to trigger the out-of-bounds read.\nS:U - Impact is confined to kernel memory disclosure and potential kernel instability within the same kernel security domain; it does not cross a VM/host or IOMMU boundary.\nC:H - put_cmsg() can copy up to 2040 bytes past the actual extension header into userspace ancillary data, leaking adjacent slab/kernel memory (confirmed by KASAN slab-out-of-bounds in put_cmsg).\nI:N - The bug is an out-of-bounds read that copies kernel data to userspace; it does not modify kernel memory, corrupt control structures, or provide a write primitive.\nA:H - The out-of-bounds slab read can provoke a KASAN fault/kernel oops during put_cmsg(), and repeated triggering can deny availability of the affected system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:14.814Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/81394827dfb72772c50d0ae3bdfa094428a5d76d"
},
{
"url": "https://git.kernel.org/stable/c/931b4a1f13408c2507719890f78f7227c34a0282"
},
{
"url": "https://git.kernel.org/stable/c/08464413e628803bd10cb1df68d0138665f2f885"
},
{
"url": "https://git.kernel.org/stable/c/a29768d56eb3798c052ad3281b05596e695a17af"
},
{
"url": "https://git.kernel.org/stable/c/0d330eff318c0f44d4fb0ad2c2aef38f87f24c90"
},
{
"url": "https://git.kernel.org/stable/c/a35daeabb433686234b010ebf7b53778dbd6c9b8"
},
{
"url": "https://git.kernel.org/stable/c/eb18a1b1644e4cad978df2131e2bb9a2e6886992"
},
{
"url": "https://git.kernel.org/stable/c/dd433671fef381fdaf7b530c631e6b782d66e224"
}
],
"title": "ipv6: validate extension header length before copying to cmsg",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63920",
"datePublished": "2026-07-19T14:55:22.813Z",
"dateReserved": "2026-07-19T07:54:57.020Z",
"dateUpdated": "2026-10-19T20:17:56.265Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64017 (GCVE-0-2026-64017)
Vulnerability from cvelistv5
Published
2026-07-19 15:39
Modified
2026-10-30 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
blk-mq: pop cached request if it is usable
When submitting a bio to blk-mq, if the task should sleep after peeking
a cached request, but before it pops it, the plug flushes and calls
blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a
use-after-free bug. Fix this by popping the cached request before any
possible blocking calls if it is suitable for use.
Popping this request first holds a queue reference, so avoid any
serialization races with queue freezes and can safely proceed with
dispatching that request to the driver. This potentially increases a
timing window from when a driver wants to freeze its queue to when
requests stop being dispatched. That scenario is off the fast path
though, and drivers need to appropriately handle requests during a
freeze request anyway.
The downside is the popped element needs to be individually freed when
we performed a bio plug merge. The cached request would have had to be
freed later anyway, but this patch does it inline with building the plug
list instead of after flushing it.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9 Version: b80056bd75a16e4550873ecefe12bc8fd190b1cf Version: b0077e269f6c152e807fdac90b58caf012cdbaab Version: b0077e269f6c152e807fdac90b58caf012cdbaab Version: b0077e269f6c152e807fdac90b58caf012cdbaab Version: b0077e269f6c152e807fdac90b58caf012cdbaab Version: e9c309ded295b7f8849097d71ae231456ca79f78 Version: 33cf52b6e53a6aa55883aa7fb9ceffceff8488a6 Version: 8b6075046470c8756242dfe3fd058813636f69a3 Version: 6.1.72 ≤ Version: 6.6.3 ≤ Version: 6.5.13 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64017",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:35:20.104687Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:08.507Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/blk-mq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a3fefe65b94b095c9b66420ee0ecabd9fc2e1568",
"status": "affected",
"version": "b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9",
"versionType": "git"
},
{
"lessThan": "f122d9968d730c2e71d5e59d0d8b7d67acb5b3bb",
"status": "affected",
"version": "b80056bd75a16e4550873ecefe12bc8fd190b1cf",
"versionType": "git"
},
{
"lessThan": "23d8ea1e303b5f32d883757a4a707e791dbc9808",
"status": "affected",
"version": "b0077e269f6c152e807fdac90b58caf012cdbaab",
"versionType": "git"
},
{
"lessThan": "97e2d08de282ef76f84ab4ccd00f1acb3f5f999e",
"status": "affected",
"version": "b0077e269f6c152e807fdac90b58caf012cdbaab",
"versionType": "git"
},
{
"lessThan": "388468f7e7d1eab092cf2a39fdfb502e52019ec6",
"status": "affected",
"version": "b0077e269f6c152e807fdac90b58caf012cdbaab",
"versionType": "git"
},
{
"lessThan": "dc278e9bf2b9513a763353e6b9cc21e0f532954e",
"status": "affected",
"version": "b0077e269f6c152e807fdac90b58caf012cdbaab",
"versionType": "git"
},
{
"status": "affected",
"version": "e9c309ded295b7f8849097d71ae231456ca79f78",
"versionType": "git"
},
{
"status": "affected",
"version": "33cf52b6e53a6aa55883aa7fb9ceffceff8488a6",
"versionType": "git"
},
{
"status": "affected",
"version": "8b6075046470c8756242dfe3fd058813636f69a3",
"versionType": "git"
},
{
"lessThan": "6.1.191",
"status": "affected",
"version": "6.1.72",
"versionType": "semver"
},
{
"lessThan": "6.6.161",
"status": "affected",
"version": "6.6.3",
"versionType": "semver"
},
{
"lessThan": "6.6",
"status": "affected",
"version": "6.5.13",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/blk-mq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.1.72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "6.6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: pop cached request if it is usable\n\nWhen submitting a bio to blk-mq, if the task should sleep after peeking\na cached request, but before it pops it, the plug flushes and calls\nblk_mq_free_plug_rqs, freeing the cached_rqs. This creates a\nuse-after-free bug. Fix this by popping the cached request before any\npossible blocking calls if it is suitable for use.\n\nPopping this request first holds a queue reference, so avoid any\nserialization races with queue freezes and can safely proceed with\ndispatching that request to the driver. This potentially increases a\ntiming window from when a driver wants to freeze its queue to when\nrequests stop being dispatched. That scenario is off the fast path\nthough, and drivers need to appropriately handle requests during a\nfreeze request anyway.\n\nThe downside is the popped element needs to be individually freed when\nwe performed a bio plug merge. The cached request would have had to be\nfreed later anyway, but this patch does it inline with building the plug\nlist instead of after flushing it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in `blk_mq_submit_bio()`, reached from local block I/O submission (`submit_bio` via read/write, filesystem I/O, or io_uring). Reliable exploitation requires a `blk_plug` with populated `cached_rqs`, which occurs when io_uring submits batches of 3+ plugged read/write operations (`blk_start_plug_nr_ios`); remote-only paths like nfsd/ksmbd/nvmet typically use `blk_start_plug()` with `nr_ios=1` and do not populate the cached-request list needed to hit the peek-without-pop window.\nAC:L - An attacker controls both sides of the race by batching io_uring I/O and inducing a sleep between peek and pop (e.g., memory pressure during bio split/allocation, or `bio_integrity_prep()` blocking on PI-capable enterprise/cloud NVMe). Plug flush on any schedule is deterministic kernel behavior, not an uncontrollable environmental condition.\nPR:L - Triggering requires only an unprivileged local process able to perform block-backed I/O (normal file read/write or io_uring readv/writev to accessible storage); no root, `CAP_SYS_ADMIN`, or special kernel capabilities are needed beyond standard filesystem/device access available to any local user.\nUI:N - Exploitation is driven entirely by the attacker\u0027s own I/O submissions through io_uring or direct block I/O; no action by another user or administrator is required.\nS:U - Impact is confined to kernel memory via a block-layer use-after-free on `struct request`; this is standard kernel privilege escalation territory and does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - This is a use-after-free of a `struct request` object; the attacker can influence post-free heap contents and dereference freed fields (`rq-\u003eq`, `rq-\u003emq_hctx`, `rq-\u003ebio`), enabling arbitrary kernel memory read primitives.\nI:H - UAF on `struct request` permits controlled writes through subsequent use of the dangling object (`rq-\u003ecmd_flags`, `queuelist`, bio attachment in `blk_mq_bio_to_request`), enabling heap corruption and potential arbitrary code execution in kernel context.\nA:H - The freed request is dereferenced during `blk_mq_use_cached_rq()` and subsequent request setup, causing kernel oops/panic; even without full exploitation, UAF reliably threatens system availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:28.823Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a3fefe65b94b095c9b66420ee0ecabd9fc2e1568"
},
{
"url": "https://git.kernel.org/stable/c/f122d9968d730c2e71d5e59d0d8b7d67acb5b3bb"
},
{
"url": "https://git.kernel.org/stable/c/23d8ea1e303b5f32d883757a4a707e791dbc9808"
},
{
"url": "https://git.kernel.org/stable/c/97e2d08de282ef76f84ab4ccd00f1acb3f5f999e"
},
{
"url": "https://git.kernel.org/stable/c/388468f7e7d1eab092cf2a39fdfb502e52019ec6"
},
{
"url": "https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954e"
}
],
"title": "blk-mq: pop cached request if it is usable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64017",
"datePublished": "2026-07-19T15:39:11.989Z",
"dateReserved": "2026-07-19T07:54:57.027Z",
"dateUpdated": "2026-10-30T12:27:28.823Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80863 (GCVE-0-2026-80863)
Vulnerability from cvelistv5
Published
2026-09-04 15:55
Modified
2026-10-19 08:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix OOB in free_rd_atomic_resources()
free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic.
Updating max_dest_rd_atomic before freeing the old array can make the
free path walk past the old allocation and trigger a slab out-of-bounds
write catched by KASAN:
==================================================================
BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline]
BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline]
BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline]
BUG: KASAN: slab-out-of-bounds in rxe_qp_from_attr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:712
Write of size 4 at addr ffff88802b8dddb8 by task syz.3.451/11063
CPU: 0 UID: 0 PID: 11063 Comm: syz.3.451 Not tainted 7.1.0 #2 PREEMPT(full)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x10e/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xf7/0x600 mm/kasan/report.c:482
kasan_report+0xe4/0x120 mm/kasan/report.c:595
free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline]
free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline]
free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline]
rxe_qp_from_attr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:712
rxe_modify_qp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxe_verbs.c:623
ib_security_modify_qp+0x223/0xfa0 drivers/infiniband/core/security.c:625
_ib_modify_qp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915
modify_qp+0x13ca/0x1940 drivers/infiniband/core/uverbs_cmd.c:1932
ib_uverbs_modify_qp+0xcb/0x120 drivers/infiniband/core/uverbs_cmd.c:1958
ib_uverbs_write+0xb86/0x1030 drivers/infiniband/core/uverbs_main.c:680
vfs_write+0x2aa/0x1070 fs/read_write.c:686
ksys_write+0x1f8/0x250 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fefc75a70cd
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fefc8495018 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fefc7835fa0 RCX: 00007fefc75a70cd
RDX: 0000000000000078 RSI: 0000200000000240 RDI: 0000000000000007
RBP: 00007fefc764f10f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fefc7836038 R14: 00007fefc7835fa0 R15: 00007ffcf0586aa0
</TASK>
Allocated by task 11063:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5296 [inline]
__kmalloc_noprof+0x32a/0x850 mm/slub.c:5308
kmalloc_noprof include/linux/slab.h:954 [inline]
kzalloc_noprof include/linux/slab.h:1188 [inline]
alloc_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:155 [inline]
rxe_qp_from_attr+0x3f8/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:714
rxe_modify_qp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxe_verbs.c:623
ib_security_modify_qp+0x223/0xfa0 drivers/infiniband/core/security.c:625
_ib_modify_qp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915
modify_qp+0x13ca/0x1940 drivers/infiniband/core/uverbs_cmd.c:1932
ib_uverbs_modify_qp+0xcb/0x120 drivers/infiniband/core/uverbs_cmd.c:1958
ib_uverbs_write+0xb86/0x1030 drivers/infiniband/core/uverbs_ma
---truncated---
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f Version: b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f Version: b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f Version: b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f Version: b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f Version: b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f Version: b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f Version: b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f Version: b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_qp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "142c8165b7974b40fa62c393653edb5c00b8b5fe",
"status": "affected",
"version": "b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f",
"versionType": "git"
},
{
"lessThan": "30b90b55201902b2b8edcdbe2315ccd4c7547002",
"status": "affected",
"version": "b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f",
"versionType": "git"
},
{
"lessThan": "9b7d66ea88ae9395e42766b94a5c717b158b940a",
"status": "affected",
"version": "b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f",
"versionType": "git"
},
{
"lessThan": "f5e6580a3a16a83c743ad5a7c16922854a0d8b71",
"status": "affected",
"version": "b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f",
"versionType": "git"
},
{
"lessThan": "bc6e943794515d2a8417b02597a27bd377468d04",
"status": "affected",
"version": "b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f",
"versionType": "git"
},
{
"lessThan": "bdf5deccfbf9f556a08d1d2ef52e9e48f969e53e",
"status": "affected",
"version": "b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f",
"versionType": "git"
},
{
"lessThan": "4e5f753e8c280278c09f68fe728abf846e2bdfc1",
"status": "affected",
"version": "b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f",
"versionType": "git"
},
{
"lessThan": "d219e7a8eed3802970c3e4d243d79c70ef0a31bf",
"status": "affected",
"version": "b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f",
"versionType": "git"
},
{
"lessThan": "de329533792a373186d79dca1ca120f8fa0afd05",
"status": "affected",
"version": "b6bbee0d2438a2c9c7525f5bd7047a8b2ce4f38f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_qp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.269",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.220",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.187",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.156",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.269",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.220",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.187",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.156",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.108",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.49",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.13",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.3",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix OOB in free_rd_atomic_resources()\n\nfree_rd_atomic_resources() iterates using qp-\u003eattr.max_dest_rd_atomic.\nUpdating max_dest_rd_atomic before freeing the old array can make the\nfree path walk past the old allocation and trigger a slab out-of-bounds\nwrite catched by KASAN:\n==================================================================\nBUG: KASAN: slab-out-of-bounds in free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline]\nBUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline]\nBUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline]\nBUG: KASAN: slab-out-of-bounds in rxe_qp_from_attr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:712\nWrite of size 4 at addr ffff88802b8dddb8 by task syz.3.451/11063\n\nCPU: 0 UID: 0 PID: 11063 Comm: syz.3.451 Not tainted 7.1.0 #2 PREEMPT(full)\nHardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x10e/0x1f0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xf7/0x600 mm/kasan/report.c:482\n kasan_report+0xe4/0x120 mm/kasan/report.c:595\n free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline]\n free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline]\n free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline]\n rxe_qp_from_attr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:712\n rxe_modify_qp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxe_verbs.c:623\n ib_security_modify_qp+0x223/0xfa0 drivers/infiniband/core/security.c:625\n _ib_modify_qp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915\n modify_qp+0x13ca/0x1940 drivers/infiniband/core/uverbs_cmd.c:1932\n ib_uverbs_modify_qp+0xcb/0x120 drivers/infiniband/core/uverbs_cmd.c:1958\n ib_uverbs_write+0xb86/0x1030 drivers/infiniband/core/uverbs_main.c:680\n vfs_write+0x2aa/0x1070 fs/read_write.c:686\n ksys_write+0x1f8/0x250 fs/read_write.c:740\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fefc75a70cd\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fefc8495018 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 00007fefc7835fa0 RCX: 00007fefc75a70cd\nRDX: 0000000000000078 RSI: 0000200000000240 RDI: 0000000000000007\nRBP: 00007fefc764f10f R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007fefc7836038 R14: 00007fefc7835fa0 R15: 00007ffcf0586aa0\n \u003c/TASK\u003e\n\nAllocated by task 11063:\n kasan_save_stack+0x33/0x60 mm/kasan/common.c:57\n kasan_save_track+0x14/0x30 mm/kasan/common.c:78\n poison_kmalloc_redzone mm/kasan/common.c:398 [inline]\n __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415\n kasan_kmalloc include/linux/kasan.h:263 [inline]\n __do_kmalloc_node mm/slub.c:5296 [inline]\n __kmalloc_noprof+0x32a/0x850 mm/slub.c:5308\n kmalloc_noprof include/linux/slab.h:954 [inline]\n kzalloc_noprof include/linux/slab.h:1188 [inline]\n alloc_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:155 [inline]\n rxe_qp_from_attr+0x3f8/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:714\n rxe_modify_qp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxe_verbs.c:623\n ib_security_modify_qp+0x223/0xfa0 drivers/infiniband/core/security.c:625\n _ib_modify_qp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915\n modify_qp+0x13ca/0x1940 drivers/infiniband/core/uverbs_cmd.c:1932\n ib_uverbs_modify_qp+0xcb/0x120 drivers/infiniband/core/uverbs_cmd.c:1958\n ib_uverbs_write+0xb86/0x1030 drivers/infiniband/core/uverbs_ma\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:44:57.409Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/142c8165b7974b40fa62c393653edb5c00b8b5fe"
},
{
"url": "https://git.kernel.org/stable/c/30b90b55201902b2b8edcdbe2315ccd4c7547002"
},
{
"url": "https://git.kernel.org/stable/c/9b7d66ea88ae9395e42766b94a5c717b158b940a"
},
{
"url": "https://git.kernel.org/stable/c/f5e6580a3a16a83c743ad5a7c16922854a0d8b71"
},
{
"url": "https://git.kernel.org/stable/c/bc6e943794515d2a8417b02597a27bd377468d04"
},
{
"url": "https://git.kernel.org/stable/c/bdf5deccfbf9f556a08d1d2ef52e9e48f969e53e"
},
{
"url": "https://git.kernel.org/stable/c/4e5f753e8c280278c09f68fe728abf846e2bdfc1"
},
{
"url": "https://git.kernel.org/stable/c/d219e7a8eed3802970c3e4d243d79c70ef0a31bf"
},
{
"url": "https://git.kernel.org/stable/c/de329533792a373186d79dca1ca120f8fa0afd05"
}
],
"title": "RDMA/rxe: Fix OOB in free_rd_atomic_resources()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80863",
"datePublished": "2026-09-04T15:55:17.668Z",
"dateReserved": "2026-08-26T14:34:25.798Z",
"dateUpdated": "2026-10-19T08:44:57.409Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64541 (GCVE-0-2026-64541)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-10-19 20:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
smc_cdc_rx_handler() looks up the connection by token under the link
group's conns_lock, drops the lock, and then dereferences conn and the
smc_sock derived from it, ending in sock_hold(&smc->sk) inside
smc_cdc_msg_recv(). No reference is held across the lock release.
The only reference pinning the socket while the connection is
discoverable in the link group is taken in smc_lgr_register_conn()
(sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both
under conns_lock. Once the handler drops conns_lock, a concurrent
close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn()
can drop that reference and free the smc_sock, so the handler's later
sock_hold() runs on freed memory:
WARNING: lib/refcount.c:25 at refcount_warn_saturate
Workqueue: rxe_wq do_work
refcount_warn_saturate (lib/refcount.c:25)
smc_cdc_msg_recv (net/smc/smc_cdc.c:430)
smc_cdc_rx_handler (net/smc/smc_cdc.c:502)
smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445)
tasklet_action_common (kernel/softirq.c:938)
handle_softirqs (kernel/softirq.c:622)
Kernel panic - not syncing: panic_on_warn set
Only SMC-R is affected. The SMC-D receive tasklet is stopped by
tasklet_kill(&conn->rx_tsklet) in smc_conn_free() before the connection
is unregistered, so it cannot run concurrently with the free.
Take the socket reference while still holding conns_lock, so the
registration reference can no longer be the last one, and drop it once
the handler is done.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64541",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:42:09.809089Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:48:39.587Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/smc/smc_cdc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8de4f665d0febfb92803dece377791a563fc7041",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "8145b432136285e01091815b48ceb2dae261f262",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "1951bffbc6493ec34cff3956b29d4bc6606904a6",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "647b19e5cc145a2f1f685ae8ff3805a17356888c",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "472e9d7c0d5b03be3ff91ff941f57da822b031bc",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "ce5aa8084329351086894aa34d77e40301d5bd3d",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "9d160b35cc34a2ba8229d07651468a7848325135",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/smc/smc_cdc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket\n\nsmc_cdc_rx_handler() looks up the connection by token under the link\ngroup\u0027s conns_lock, drops the lock, and then dereferences conn and the\nsmc_sock derived from it, ending in sock_hold(\u0026smc-\u003esk) inside\nsmc_cdc_msg_recv(). No reference is held across the lock release.\n\nThe only reference pinning the socket while the connection is\ndiscoverable in the link group is taken in smc_lgr_register_conn()\n(sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both\nunder conns_lock. Once the handler drops conns_lock, a concurrent\nclose() -\u003e smc_release() -\u003e smc_conn_free() -\u003e smc_lgr_unregister_conn()\ncan drop that reference and free the smc_sock, so the handler\u0027s later\nsock_hold() runs on freed memory:\n\n WARNING: lib/refcount.c:25 at refcount_warn_saturate\n Workqueue: rxe_wq do_work\n refcount_warn_saturate (lib/refcount.c:25)\n smc_cdc_msg_recv (net/smc/smc_cdc.c:430)\n smc_cdc_rx_handler (net/smc/smc_cdc.c:502)\n smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445)\n tasklet_action_common (kernel/softirq.c:938)\n handle_softirqs (kernel/softirq.c:622)\n Kernel panic - not syncing: panic_on_warn set\n\nOnly SMC-R is affected. The SMC-D receive tasklet is stopped by\ntasklet_kill(\u0026conn-\u003erx_tsklet) in smc_conn_free() before the connection\nis unregistered, so it cannot run concurrently with the free.\n\nTake the socket reference while still holding conns_lock, so the\nregistration reference can no longer be the last one, and drop it once\nthe handler is done."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable handler is driven entirely by a CDC control message sent by the remote SMC-R peer over the RDMA link, with an attacker-chosen `token` field and no local syscall involvement. SMC-R runs over RoCEv2 (IP/UDP-routable, port 4791) with the CLC handshake over plain TCP, and SMC-Rv2 explicitly supports non-local/routed peers, so the attacker need not share an L2 segment.\nAC:L - The attacker controls both sides of the race: it chooses when to emit CDC messages and which connection to target (the alert token is disclosed to it in the CLC accept/confirm), and it can drive the teardown side itself via CDC close/abort flags into `smc_close_passive_work()` or a stale seqno with `failover_validation` into `abort_work` -\u003e `smc_conn_kill()`. The race can be retried indefinitely across many connections in the same link group, and was reproduced in practice with soft-RoCE.\nPR:N - Establishing an SMC-R connection to a listening SMC socket requires no credentials \u2014 SMC has no authentication layer of its own, exactly like plain TCP. Everything after connection establishment (sending CDC messages with a chosen token, signalling close/abort) is available to an unauthenticated peer.\nUI:N - The CDC message is processed in a softirq tasklet from the RDMA completion queue with no involvement from any local user or application action. No victim interaction of any kind is needed.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed. This is a standard in-kernel use-after-free.\nC:H - The freed `smc_sock` is reused type-safely as another live socket, so attacker-supplied cursors applied by `smc_cdc_msg_recv_action()` break the `0 \u003c= bytes_to_rcv \u003c= rmb_desc-\u003elen` invariant and make `smc_rx_recvmsg()` hand stale RMB contents to userspace, while the urgent-data path reads `*(base + conn-\u003eurg_curs.count - 1)` at an attacker-chosen offset. Once the slab page is reclaimed after the RCU grace period, reuse is unconstrained, giving a general kernel-memory read primitive.\nI:H - `sock_hold()` on an already-zero refcount followed by `sock_put()` re-enters `sk_free()`, yielding a double free, and the handler additionally writes `sk_err`/`sk_shutdown`, makes indirect calls through `sk_data_ready()`/`sk_write_space()`, and `queue_work()`s a freed `work_struct`. These are classic heap-spray and control-flow-hijack primitives leading to arbitrary kernel write.\nA:H - The reported symptom is `refcount_warn_saturate` from `smc_cdc_msg_recv()`, which is an immediate kernel panic on `panic_on_warn` systems, and dereferencing freed memory in softirq context otherwise oopses. The attacker can trigger it repeatedly without authentication."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:17.774Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8de4f665d0febfb92803dece377791a563fc7041"
},
{
"url": "https://git.kernel.org/stable/c/8145b432136285e01091815b48ceb2dae261f262"
},
{
"url": "https://git.kernel.org/stable/c/1951bffbc6493ec34cff3956b29d4bc6606904a6"
},
{
"url": "https://git.kernel.org/stable/c/647b19e5cc145a2f1f685ae8ff3805a17356888c"
},
{
"url": "https://git.kernel.org/stable/c/472e9d7c0d5b03be3ff91ff941f57da822b031bc"
},
{
"url": "https://git.kernel.org/stable/c/3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb"
},
{
"url": "https://git.kernel.org/stable/c/ce5aa8084329351086894aa34d77e40301d5bd3d"
},
{
"url": "https://git.kernel.org/stable/c/9d160b35cc34a2ba8229d07651468a7848325135"
}
],
"title": "net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64541",
"datePublished": "2026-07-27T20:10:34.439Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-10-19T20:48:39.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80714 (GCVE-0-2026-80714)
Vulnerability from cvelistv5
Published
2026-08-28 06:53
Modified
2026-10-16 19:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvs: do not propagate one-packet flag to synced conns
Synced connections can be created before their destination exists. When
the destination is later added, ip_vs_bind_dest() copies connection flags
from the destination into cp->flags.
IP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced
connection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed,
expiry can treat it as a one-packet connection and skip unlinking the
existing conn_tab node, leaving stale hash nodes pointing at a freed
struct ip_vs_conn.
Drop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced
connections.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca Version: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca Version: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca Version: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca Version: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca Version: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca Version: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca Version: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80714",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:20:40.726937Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:34.808Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "06d1d9b56ef8132fbf85006885eb43d9510b8b02",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "acbdc276091b308ca7794acb86e761f8203e2f59",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "300348e3ba1521b003d59825f97e24f9a6859688",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "44af98cc7d5ef8e730488d5df1eecd5deeaa5947",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "4649e6faeecdc2d44bfa6ccbe405eef27e55d816",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "b5ee5b266f833601ac4817f6df0bc496fc376a28",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "e7acfc990c29890c883d0d0ce3f737d003a43b44",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.36"
},
{
"lessThan": "2.6.36",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: do not propagate one-packet flag to synced conns\n\nSynced connections can be created before their destination exists. When\nthe destination is later added, ip_vs_bind_dest() copies connection flags\nfrom the destination into cp-\u003eflags.\n\nIP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced\nconnection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed,\nexpiry can treat it as a one-packet connection and skip unlinking the\nexisting conn_tab node, leaving stale hash nodes pointing at a freed\nstruct ip_vs_conn.\n\nDrop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced\nconnections."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached on IPVS backup nodes processing UDP sync datagrams in ip_vs_process_message()/ip_vs_proc_conn() (default multicast 224.0.0.81:8848), and on internet-facing load balancers client UDP traffic drives master sync that creates the hashed backup connection before destination bind.\nAC:L - An attacker can reliably inject or refresh IPVS sync records for UDP connections whose destination is not yet present, then trigger ip_vs_try_bind_dest() once a ONEPACKET destination exists; only optional syncid filtering (often 0) is outside attacker control, and connection expiry is timer-driven without a race.\nPR:N - The backup sync receiver accepts unauthenticated UDP multicast with no capability checks in ip_vs_receive()/ip_vs_process_message(); configuring IPVS/ONEPACKET is an environmental precondition on HA load balancers, not a privilege the remote attacker must hold on the victim host.\nUI:N - Exploitation requires no victim or administrator action at trigger time beyond normal HA IPVS operation; forged or reflected sync traffic and subsequent connection expiry directly invoke the vulnerable bind/unlink path without user interaction.\nS:U - Impact is confined to the kernel IPVS connection table on the affected load-balancer node (stale hash entries to a freed struct ip_vs_conn); it does not cross a VM, container, or IOMMU security boundary.\nC:H - Incorrect ONE_PACKET handling leaves hashed conn_tab nodes pointing at a freed struct ip_vs_conn; subsequent lookups in __ip_vs_conn_in_get() dereference freed slab memory, giving a use-after-free read primitive and potential kernel pointer/data disclosure.\nI:H - The same use-after-free lets attackers influence reuse of the freed ip_vs_conn object and corrupt connection state during later hash-table operations, enabling memory corruption exploitable for arbitrary kernel writes or control-flow hijacking.\nA:H - Dereferencing stale conn_tab entries for a freed connection causes kernel oops/panic; the condition is repeatable by sending additional sync traffic to recreate and expire affected UDP synced connections on the backup node."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T06:22:30.808Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/06d1d9b56ef8132fbf85006885eb43d9510b8b02"
},
{
"url": "https://git.kernel.org/stable/c/acbdc276091b308ca7794acb86e761f8203e2f59"
},
{
"url": "https://git.kernel.org/stable/c/300348e3ba1521b003d59825f97e24f9a6859688"
},
{
"url": "https://git.kernel.org/stable/c/44af98cc7d5ef8e730488d5df1eecd5deeaa5947"
},
{
"url": "https://git.kernel.org/stable/c/4649e6faeecdc2d44bfa6ccbe405eef27e55d816"
},
{
"url": "https://git.kernel.org/stable/c/b5ee5b266f833601ac4817f6df0bc496fc376a28"
},
{
"url": "https://git.kernel.org/stable/c/e7acfc990c29890c883d0d0ce3f737d003a43b44"
},
{
"url": "https://git.kernel.org/stable/c/a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b"
}
],
"title": "ipvs: do not propagate one-packet flag to synced conns",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80714",
"datePublished": "2026-08-28T06:53:13.069Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-10-16T19:26:34.808Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90011 (GCVE-0-2026-90011)
Vulnerability from cvelistv5
Published
2026-09-16 10:33
Modified
2026-10-19 08:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Reserve a terminator byte for the login payload
iscsi_target_check_login_request() rejects a login PDU whose
DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and
login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS
bytes. Since iscsit_get_login_rx() receives payload_length + padding
bytes, where
padding = ((-payload_length) & 3);
any payload_length from 8189 to 8192 fills the whole 8192 byte
buffer. The write stays in bounds, but no byte is left for a NUL
terminator.
The buffer is subsequently consumed as a C string. In the CHAP path
chap_check_algorithm() calls kstrdup(a_str), and extract_param() calls
strstr(in_buf, pattern) followed by strlen_semi(), none of which take a
length. convert_null_to_semi() additionally rewrites every embedded NUL
to ';', so even a payload made of well formed NUL separated key=value
records is left without a terminator. These walk past the end of the
object into adjacent slab memory. It is reachable by an unauthenticated
initiator against a portal configured for CHAP; when authentication is
not required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and
the CHAP path is never entered.
Allocate one extra byte. kzalloc() zeroes it and nothing ever writes to
it, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS
bytes, so the buffer is always terminated.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/target/iscsi/iscsi_target_login.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5fac79f248c37774d1dd761406f83d25ca6ff8e4",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "6ddddcad436d8e6e619204d3c848147ff2f5bf1e",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "b19dc17ed963ac36c0db4b52a1803fb11169f91f",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "6b589ef9d5f6cdc70d2b4f269ca6cf26b5ebb076",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "eb9dadf4d552ebe10644871c5189286552aa48f5",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "1624bff4c5118ad494d50ad94d44f22064667a7f",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "3ddf3ea291a0ef2ea93b82e158960ac2cc42302b",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "f4825922d2fb371e2b969697d792077f1b62b62c",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/target/iscsi/iscsi_target_login.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"lessThan": "3.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Reserve a terminator byte for the login payload\n\niscsi_target_check_login_request() rejects a login PDU whose\nDataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is \u0027\u003e\u0027 and\nlogin-\u003ereq_buf is allocated with exactly MAX_KEY_VALUE_PAIRS\nbytes. Since iscsit_get_login_rx() receives payload_length + padding\nbytes, where\n\n\tpadding = ((-payload_length) \u0026 3);\n\nany payload_length from 8189 to 8192 fills the whole 8192 byte\nbuffer. The write stays in bounds, but no byte is left for a NUL\nterminator.\n\nThe buffer is subsequently consumed as a C string. In the CHAP path\nchap_check_algorithm() calls kstrdup(a_str), and extract_param() calls\nstrstr(in_buf, pattern) followed by strlen_semi(), none of which take a\nlength. convert_null_to_semi() additionally rewrites every embedded NUL\nto \u0027;\u0027, so even a payload made of well formed NUL separated key=value\nrecords is left without a terminator. These walk past the end of the\nobject into adjacent slab memory. It is reachable by an unauthenticated\ninitiator against a portal configured for CHAP; when authentication is\nnot required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and\nthe CHAP path is never entered.\n\nAllocate one extra byte. kzalloc() zeroes it and nothing ever writes to\nit, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS\nbytes, so the buffer is always terminated."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The LIO in-kernel iSCSI target accepts remote TCP connections on the iSCSI portal (typically port 3260); a crafted Login PDU is received by iscsit_accept_np()/iscsit_get_login_rx() and reaches the CHAP parsers over the network, the same exposure model as nfsd or ksmbd.\nAC:L - The attacker fully controls DataSegmentLength and the login payload. A CHAP_A PDU of 8189-8192 bytes with no NUL, or a second CHAP round where convert_null_to_semi() strips every terminator, makes kstrdup()/strstr() over-read adjacent slab deterministically; no race or victim-side layout is required.\nPR:N - The over-read runs in the CHAP login handshake before the password hash is checked, so no Linux account or capability is needed. Default TPG authentication is CHAP (TA_AUTHENTICATION=1), and chap_server_open() proceeds once target-side CHAP credentials exist, which is the normal CHAP deployment.\nUI:N - The attacker opens a TCP connection to the listening portal and sends the malicious Login PDUs; no victim user action such as mounting a volume or accepting a prompt is required.\nS:U - The unbounded C-string over-read and any resulting kernel oops stay inside the host iSCSI target\u0027s kernel security authority and do not by themselves cross a VM, IOMMU, or sandbox boundary.\nC:H - chap_check_algorithm() kstrdup()s the unterminated 8192-byte req_buf, and extract_param() uses unbounded strstr()/strlen_semi() after convert_null_to_semi() removes embedded NULs, producing an unbounded out-of-bounds read of adjacent kmalloc-8k slab that can disclose neighboring kernel objects.\nI:N - iscsit_get_login_rx() copies at most MAX_KEY_VALUE_PAIRS bytes into req_buf, so the network write stays in bounds; convert_null_to_semi() also writes only within payload_length. There is no out-of-bounds write or control-flow hijack primitive.\nA:H - strlen()/kstrdup()/strstr() walking past the kmalloc-8k login object into unmapped or guard pages causes a kernel oops, and the attacker can repeat the unauthenticated login against an exposed portal, denying service to the host and its iSCSI clients."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:56:25.054Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5fac79f248c37774d1dd761406f83d25ca6ff8e4"
},
{
"url": "https://git.kernel.org/stable/c/6ddddcad436d8e6e619204d3c848147ff2f5bf1e"
},
{
"url": "https://git.kernel.org/stable/c/b19dc17ed963ac36c0db4b52a1803fb11169f91f"
},
{
"url": "https://git.kernel.org/stable/c/6b589ef9d5f6cdc70d2b4f269ca6cf26b5ebb076"
},
{
"url": "https://git.kernel.org/stable/c/eb9dadf4d552ebe10644871c5189286552aa48f5"
},
{
"url": "https://git.kernel.org/stable/c/1624bff4c5118ad494d50ad94d44f22064667a7f"
},
{
"url": "https://git.kernel.org/stable/c/3ddf3ea291a0ef2ea93b82e158960ac2cc42302b"
},
{
"url": "https://git.kernel.org/stable/c/f4825922d2fb371e2b969697d792077f1b62b62c"
}
],
"title": "scsi: target: iscsi: Reserve a terminator byte for the login payload",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90011",
"datePublished": "2026-09-16T10:33:18.793Z",
"dateReserved": "2026-09-11T19:38:34.781Z",
"dateUpdated": "2026-10-19T08:56:25.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68169 (GCVE-0-2026-68169)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-11-06 16:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: userspace: fix use-after-free in get_local_id
In mptcp_pm_userspace_get_local_id(), the address entry is looked up under
spinlock, but its id is read after dropping the lock. A concurrent deletion
can free the entry between the unlock and the read, leading to UAF.
The race window is narrow. It was reproduced only with a locally
constructed stress test that repeatedly overlaps an MP_JOIN SYN with a
MPTCP_PM_CMD_SUBFLOW_DESTROY request.
However, the KASAN report below confirms that the race is reachable:
[ 666.319376] BUG: KASAN: slab-use-after-free in mptcp_userspace_pm_get_local_id+0x1dc/0x1f0
[ 666.319386] Read of size 1 at addr ffff888124845610 by task swapper/0/0
...
[ 666.319401] Call Trace:
[ 666.319405] <IRQ>
[ 666.319408] dump_stack_lvl+0x53/0x70
[ 666.319412] print_address_description.constprop.0+0x2c/0x3b0
[ 666.319418] print_report+0xbe/0x2b0
[ 666.319421] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0
[ 666.319423] kasan_report+0xce/0x100
[ 666.319426] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0
[ 666.319429] mptcp_userspace_pm_get_local_id+0x1dc/0x1f0
[ 666.319433] mptcp_pm_get_local_id+0x371/0x440
...
[ 666.319821] Allocated by task 45539:
[ 666.319844] kasan_save_stack+0x33/0x60
[ 666.319855] kasan_save_track+0x14/0x30
[ 666.319858] __kasan_kmalloc+0x8f/0xa0
[ 666.319863] __kmalloc_noprof+0x1e7/0x520
[ 666.319867] sock_kmalloc+0xdf/0x130
[ 666.319885] sock_kmemdup+0x1b/0x40
[ 666.319888] mptcp_userspace_pm_append_new_local_addr+0x261/0x500
[ 666.319910] mptcp_pm_nl_announce_doit+0x16a/0x610
...
[ 666.319967] Freed by task 45560:
[ 666.319988] kasan_save_stack+0x33/0x60
[ 666.319991] kasan_save_track+0x14/0x30
[ 666.319994] kasan_save_free_info+0x3b/0x60
[ 666.319998] __kasan_slab_free+0x43/0x70
[ 666.320000] kfree+0x166/0x440
[ 666.320003] sock_kfree_s+0x1d/0x50
[ 666.320007] mptcp_userspace_pm_delete_local_addr.isra.0+0x157/0x200
[ 666.320011] mptcp_pm_nl_subflow_destroy_doit+0x51d/0xea0
Fix by copying the id into a local variable while still holding the lock,
and use -1 as a "not found" sentinel.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e373bfc8ec3d6496ec7e11dd7f4d087a44b1009a Version: ed34dfa19ddbd1e4c85a73636f8cba0211025ea4 Version: f012d796a6de662692159c539689e47e662853a8 Version: f012d796a6de662692159c539689e47e662853a8 Version: f012d796a6de662692159c539689e47e662853a8 Version: f012d796a6de662692159c539689e47e662853a8 Version: 005a3ad289eb604216dcaa03646de36cb08624a0 Version: 6.1.79 ≤ Version: 6.6.18 ≤ Version: 6.7.6 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68169",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:43:39.883950Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:45:00.461Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mptcp/pm_userspace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8ce48d2879aafc0e7a6f8bfc3613c0ba979ec6f5",
"status": "affected",
"version": "e373bfc8ec3d6496ec7e11dd7f4d087a44b1009a",
"versionType": "git"
},
{
"lessThan": "d2c3760b45f2f481a4dd4c5adef4a29dfabd948f",
"status": "affected",
"version": "ed34dfa19ddbd1e4c85a73636f8cba0211025ea4",
"versionType": "git"
},
{
"lessThan": "31ce5af66891f79998fb2e8b8df08e3c98fd72e3",
"status": "affected",
"version": "f012d796a6de662692159c539689e47e662853a8",
"versionType": "git"
},
{
"lessThan": "d64f6c02495f3fad674038cfa7ec049671b59e7b",
"status": "affected",
"version": "f012d796a6de662692159c539689e47e662853a8",
"versionType": "git"
},
{
"lessThan": "40dde4b5d98279471a70e5c8bb713182738c00d9",
"status": "affected",
"version": "f012d796a6de662692159c539689e47e662853a8",
"versionType": "git"
},
{
"lessThan": "9bc6d5e4ca9f3cbb41d43400b3a31cb0403796c9",
"status": "affected",
"version": "f012d796a6de662692159c539689e47e662853a8",
"versionType": "git"
},
{
"status": "affected",
"version": "005a3ad289eb604216dcaa03646de36cb08624a0",
"versionType": "git"
},
{
"lessThan": "6.1.184",
"status": "affected",
"version": "6.1.79",
"versionType": "semver"
},
{
"lessThan": "6.6.151",
"status": "affected",
"version": "6.6.18",
"versionType": "semver"
},
{
"lessThan": "6.8",
"status": "affected",
"version": "6.7.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mptcp/pm_userspace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "6.1.79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "6.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: userspace: fix use-after-free in get_local_id\n\nIn mptcp_pm_userspace_get_local_id(), the address entry is looked up under\nspinlock, but its id is read after dropping the lock. A concurrent deletion\ncan free the entry between the unlock and the read, leading to UAF.\n\nThe race window is narrow. It was reproduced only with a locally\nconstructed stress test that repeatedly overlaps an MP_JOIN SYN with a\nMPTCP_PM_CMD_SUBFLOW_DESTROY request.\n\nHowever, the KASAN report below confirms that the race is reachable:\n\n [ 666.319376] BUG: KASAN: slab-use-after-free in mptcp_userspace_pm_get_local_id+0x1dc/0x1f0\n [ 666.319386] Read of size 1 at addr ffff888124845610 by task swapper/0/0\n ...\n [ 666.319401] Call Trace:\n [ 666.319405] \u003cIRQ\u003e\n [ 666.319408] dump_stack_lvl+0x53/0x70\n [ 666.319412] print_address_description.constprop.0+0x2c/0x3b0\n [ 666.319418] print_report+0xbe/0x2b0\n [ 666.319421] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0\n [ 666.319423] kasan_report+0xce/0x100\n [ 666.319426] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0\n [ 666.319429] mptcp_userspace_pm_get_local_id+0x1dc/0x1f0\n [ 666.319433] mptcp_pm_get_local_id+0x371/0x440\n ...\n [ 666.319821] Allocated by task 45539:\n [ 666.319844] kasan_save_stack+0x33/0x60\n [ 666.319855] kasan_save_track+0x14/0x30\n [ 666.319858] __kasan_kmalloc+0x8f/0xa0\n [ 666.319863] __kmalloc_noprof+0x1e7/0x520\n [ 666.319867] sock_kmalloc+0xdf/0x130\n [ 666.319885] sock_kmemdup+0x1b/0x40\n [ 666.319888] mptcp_userspace_pm_append_new_local_addr+0x261/0x500\n [ 666.319910] mptcp_pm_nl_announce_doit+0x16a/0x610\n ...\n [ 666.319967] Freed by task 45560:\n [ 666.319988] kasan_save_stack+0x33/0x60\n [ 666.319991] kasan_save_track+0x14/0x30\n [ 666.319994] kasan_save_free_info+0x3b/0x60\n [ 666.319998] __kasan_slab_free+0x43/0x70\n [ 666.320000] kfree+0x166/0x440\n [ 666.320003] sock_kfree_s+0x1d/0x50\n [ 666.320007] mptcp_userspace_pm_delete_local_addr.isra.0+0x157/0x200\n [ 666.320011] mptcp_pm_nl_subflow_destroy_doit+0x51d/0xea0\n\nFix by copying the id into a local variable while still holding the lock,\nand use -1 as a \"not found\" sentinel."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:46:03.401Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8ce48d2879aafc0e7a6f8bfc3613c0ba979ec6f5"
},
{
"url": "https://git.kernel.org/stable/c/d2c3760b45f2f481a4dd4c5adef4a29dfabd948f"
},
{
"url": "https://git.kernel.org/stable/c/31ce5af66891f79998fb2e8b8df08e3c98fd72e3"
},
{
"url": "https://git.kernel.org/stable/c/d64f6c02495f3fad674038cfa7ec049671b59e7b"
},
{
"url": "https://git.kernel.org/stable/c/40dde4b5d98279471a70e5c8bb713182738c00d9"
},
{
"url": "https://git.kernel.org/stable/c/9bc6d5e4ca9f3cbb41d43400b3a31cb0403796c9"
}
],
"title": "mptcp: pm: userspace: fix use-after-free in get_local_id",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68169",
"datePublished": "2026-08-10T11:59:38.177Z",
"dateReserved": "2026-07-30T09:28:09.372Z",
"dateUpdated": "2026-11-06T16:45:00.461Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74586 (GCVE-0-2026-74586)
Vulnerability from cvelistv5
Published
2026-08-22 15:31
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: clear new_transport when removing a peer
sctp_process_asconf_param() stores a newly added peer transport in
asoc->new_transport. After all parameters in the ASCONF chunk have been
processed, sctp_sf_do_asconf() uses this pointer to send a HEARTBEAT to the
new transport.
An authenticated ASCONF from a remote SCTP peer can add a transport and
remove it again with a wildcard DEL-IP parameter in the same chunk. The
wildcard deletion preserves the transport on which the ASCONF arrived, but
removes the newly added transport through
sctp_assoc_del_nonprimary_peers(). The removal does not clear
asoc->new_transport, leaving it pointing to the removed transport.
sctp_sf_do_asconf() then creates a HEARTBEAT whose chunk->transport points
to the removed transport without holding a transport reference. During
local address replacement, src_out_of_asoc_ok keeps this HEARTBEAT on
control_chunk_list. After the transport is freed by RCU, a successful
ASCONF_ACK for the replacement address releases the queued HEARTBEAT and
sctp_outq_select_transport() reads the freed transport's state.
The issue was found during a static audit of SCTP objects. With an
authenticated peer, the reproducer triggered the same KASAN report in 2
of 2 unpatched runs on a KASAN-enabled netdev/main kernel:
BUG: KASAN: slab-use-after-free in sctp_outq_select_transport
Read of size 4 at addr ffff88800b9bd95c by task python3/197
Call Trace:
sctp_outq_select_transport+0x549/0x8b0 [sctp]
sctp_outq_flush+0x306/0x2c60 [sctp]
sctp_transport_immediate_rtx+0xaf/0x260 [sctp]
sctp_process_asconf_ack+0xa48/0xf70 [sctp]
Allocated by task 197:
sctp_transport_new+0x68/0x650 [sctp]
sctp_assoc_add_peer+0x258/0x12a0 [sctp]
sctp_process_asconf+0x5e9/0x1090 [sctp]
Last potentially related work creation:
__call_rcu_common.constprop.0+0x77/0xb70
sctp_assoc_del_nonprimary_peers+0x7c/0xd0 [sctp]
sctp_process_asconf+0xd9c/0x1090 [sctp]
The first invalid access was a four-byte read of transport->state at
net/sctp/outqueue.c:833. The same reproducer completed the full
authenticated ASCONF and local-address replacement sequence with this
change without a KASAN report or oops.
Clear new_transport when its peer is removed, before it can be used to
create the HEARTBEAT.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf Version: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf Version: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf Version: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf Version: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf Version: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf Version: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf Version: 6af29ccc223b0feb6fc6112281c3fa3cdb1afddf |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74586",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:01:22.679570Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:58.687Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/associola.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c0f973bb5118dd1b146cda3fcc8af6f6057befec",
"status": "affected",
"version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
"versionType": "git"
},
{
"lessThan": "3b539b317cd052236fed0350364ff1268996ba46",
"status": "affected",
"version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
"versionType": "git"
},
{
"lessThan": "db9d8e3b670f841755bc2018f178472dc6064d27",
"status": "affected",
"version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
"versionType": "git"
},
{
"lessThan": "31efa656cf6aface26e88f038c14f22ee6ca1500",
"status": "affected",
"version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
"versionType": "git"
},
{
"lessThan": "291accf36febce751021888de5f15090f4875b56",
"status": "affected",
"version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
"versionType": "git"
},
{
"lessThan": "ca33df36aa0143a1d04f57d2086020c12e7eddb7",
"status": "affected",
"version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
"versionType": "git"
},
{
"lessThan": "163847552a571bd55094291f4ffcdc1de0f14a7b",
"status": "affected",
"version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
"versionType": "git"
},
{
"lessThan": "beb33f8ee1ca83acddb2a5ae80f3d22ec550b4c3",
"status": "affected",
"version": "6af29ccc223b0feb6fc6112281c3fa3cdb1afddf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/associola.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: clear new_transport when removing a peer\n\nsctp_process_asconf_param() stores a newly added peer transport in\nasoc-\u003enew_transport. After all parameters in the ASCONF chunk have been\nprocessed, sctp_sf_do_asconf() uses this pointer to send a HEARTBEAT to the\nnew transport.\n\nAn authenticated ASCONF from a remote SCTP peer can add a transport and\nremove it again with a wildcard DEL-IP parameter in the same chunk. The\nwildcard deletion preserves the transport on which the ASCONF arrived, but\nremoves the newly added transport through\nsctp_assoc_del_nonprimary_peers(). The removal does not clear\nasoc-\u003enew_transport, leaving it pointing to the removed transport.\n\nsctp_sf_do_asconf() then creates a HEARTBEAT whose chunk-\u003etransport points\nto the removed transport without holding a transport reference. During\nlocal address replacement, src_out_of_asoc_ok keeps this HEARTBEAT on\ncontrol_chunk_list. After the transport is freed by RCU, a successful\nASCONF_ACK for the replacement address releases the queued HEARTBEAT and\nsctp_outq_select_transport() reads the freed transport\u0027s state.\n\nThe issue was found during a static audit of SCTP objects. With an\nauthenticated peer, the reproducer triggered the same KASAN report in 2\nof 2 unpatched runs on a KASAN-enabled netdev/main kernel:\n\n BUG: KASAN: slab-use-after-free in sctp_outq_select_transport\n Read of size 4 at addr ffff88800b9bd95c by task python3/197\n\n Call Trace:\n sctp_outq_select_transport+0x549/0x8b0 [sctp]\n sctp_outq_flush+0x306/0x2c60 [sctp]\n sctp_transport_immediate_rtx+0xaf/0x260 [sctp]\n sctp_process_asconf_ack+0xa48/0xf70 [sctp]\n\n Allocated by task 197:\n sctp_transport_new+0x68/0x650 [sctp]\n sctp_assoc_add_peer+0x258/0x12a0 [sctp]\n sctp_process_asconf+0x5e9/0x1090 [sctp]\n\n Last potentially related work creation:\n __call_rcu_common.constprop.0+0x77/0xb70\n sctp_assoc_del_nonprimary_peers+0x7c/0xd0 [sctp]\n sctp_process_asconf+0xd9c/0x1090 [sctp]\n\nThe first invalid access was a four-byte read of transport-\u003estate at\nnet/sctp/outqueue.c:833. The same reproducer completed the full\nauthenticated ASCONF and local-address replacement sequence with this\nchange without a KASAN report or oops.\n\nClear new_transport when its peer is removed, before it can be used to\ncreate the HEARTBEAT."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is triggered when a remote SCTP peer sends an authenticated ASCONF chunk that is processed via sctp_rcv() through the state machine into sctp_sf_do_asconf() and sctp_process_asconf(); this is standard network packet handling, not a local syscall or ioctl path.\nAC:L - The remote peer fully controls a single ASCONF containing ADD_IP followed by wildcard DEL-IP to add then remove a transport while leaving asoc-\u003enew_transport dangling; combined with routine SCTP local address replacement (src_out_of_asoc_ok), the KASAN reproducer hit the UAF in 2/2 runs.\nPR:N - Exploitation requires only being an established SCTP association peer sending SCTP-AUTH-protected ASCONF traffic negotiated during the normal handshake (or addip_noauth); no Linux account, capability, or init-namespace privilege is needed on the victim host.\nUI:N - No victim user action such as opening a file or mounting a filesystem is required; the kernel automatically processes attacker-crafted ASCONF packets on an existing SCTP association during normal server operation.\nS:U - Impact is confined to kernel heap corruption on the vulnerable host (slab UAF on sctp_transport) and potential privilege escalation within that kernel; it does not cross VM, container, or IOMMU security boundaries.\nC:H - KASAN reports slab-use-after-free with a 4-byte read of freed sctp_transport-\u003estate in sctp_outq_select_transport(); UAF on heap transport objects enables grooming for arbitrary kernel memory disclosure per kernel CVSS guidance.\nI:H - The dangling sctp_transport pointer is embedded in a queued HEARTBEAT control chunk without a reference; UAF on this heap object can be leveraged via heap spraying for arbitrary kernel writes and control-flow hijacking, not merely a bounded corruption.\nA:H - Dereferencing the freed transport during sctp_outq_flush() causes a reproducible kernel UAF/oops; remote peers can repeatedly trigger this against SCTP endpoints handling ADD-IP traffic, yielding denial of service or crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:12.552Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c0f973bb5118dd1b146cda3fcc8af6f6057befec"
},
{
"url": "https://git.kernel.org/stable/c/3b539b317cd052236fed0350364ff1268996ba46"
},
{
"url": "https://git.kernel.org/stable/c/db9d8e3b670f841755bc2018f178472dc6064d27"
},
{
"url": "https://git.kernel.org/stable/c/31efa656cf6aface26e88f038c14f22ee6ca1500"
},
{
"url": "https://git.kernel.org/stable/c/291accf36febce751021888de5f15090f4875b56"
},
{
"url": "https://git.kernel.org/stable/c/ca33df36aa0143a1d04f57d2086020c12e7eddb7"
},
{
"url": "https://git.kernel.org/stable/c/163847552a571bd55094291f4ffcdc1de0f14a7b"
},
{
"url": "https://git.kernel.org/stable/c/beb33f8ee1ca83acddb2a5ae80f3d22ec550b4c3"
}
],
"title": "sctp: clear new_transport when removing a peer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74586",
"datePublished": "2026-08-22T15:31:39.094Z",
"dateReserved": "2026-08-15T05:44:03.918Z",
"dateUpdated": "2026-10-16T19:05:58.687Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63875 (GCVE-0-2026-63875)
Vulnerability from cvelistv5
Published
2026-07-19 14:54
Modified
2026-10-19 20:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
arm64: tlb: Flush walk cache when unsharing PMD tables
When huge_pmd_unshare() is called to unshare a PMD table, the
tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=true
but the aarch64 tlb_flush() only checked tlb->freed_tables to
determine whether to use TLBF_NONE (vae1is, invalidates walk
cache) or TLBF_NOWALKCACHE (vale1is, leaf-only).
This caused the stale PMD page table entry to remain in the walk cache
after unshare, potentially leading to incorrect page table walks.
Fix by including unshared_tables in the check, so that when
unsharing tables, TLBF_NONE is used and the walk cache is properly
invalidated.
Here is the detailed distinction between vae1is and vale1is:
| Instruction Combination | Actual Invalidation Scope |
| ------------------------ | --------------------------------------------------|
| `VAE1IS` + TTL=`0` | All entries at all levels (full invalidation) |
| `VAE1IS` + TTL=`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2 |
| `VALE1IS` + TTL=`0` | Leaf entries at all levels (non-leaf not cleared) |
| `VALE1IS` + TTL=`2` (L2) | Leaf entry at Level 2 only |
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6495204f8219a57859669d618b25d06176d5a872 Version: ce4cf24761467756462c0e1dbe4a5e9c9eb520fc Version: daa6707b71a2da23a82979fa21f788aeb706f1a2 Version: ff37dd18ce7739a26aab0cc2d31006a45e6bde63 Version: da06bb0ca45b1ca6f1ab55023e34e61a520337f3 Version: 9b671f6f432be07c0ddd66e437d6d0e0db684f83 Version: 8ce720d5bd91e9dc16db3604aa4b1bf76770a9a1 Version: 8ce720d5bd91e9dc16db3604aa4b1bf76770a9a1 Version: 5.10.253 ≤ Version: 5.15.203 ≤ Version: 6.1.167 ≤ Version: 6.6.127 ≤ Version: 6.12.74 ≤ Version: 6.18.13 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63875",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:32:42.432974Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-459",
"description": "CWE-459 Incomplete Cleanup",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:53.723Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/include/asm/tlb.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dced308d7d6a0de1c09d2058f38f1aaaf5cbb914",
"status": "affected",
"version": "6495204f8219a57859669d618b25d06176d5a872",
"versionType": "git"
},
{
"lessThan": "47490bbb05c8c0e09cc3cfd237d8934ffc340583",
"status": "affected",
"version": "ce4cf24761467756462c0e1dbe4a5e9c9eb520fc",
"versionType": "git"
},
{
"lessThan": "0199c9d57861f17b556b6cba1f765c7cce79745b",
"status": "affected",
"version": "daa6707b71a2da23a82979fa21f788aeb706f1a2",
"versionType": "git"
},
{
"lessThan": "d766a49d9b55705c4737cd8bb5d3faa2d31330fd",
"status": "affected",
"version": "ff37dd18ce7739a26aab0cc2d31006a45e6bde63",
"versionType": "git"
},
{
"lessThan": "8ca7284da0e67b3e71d90ec17f08286774245ad9",
"status": "affected",
"version": "da06bb0ca45b1ca6f1ab55023e34e61a520337f3",
"versionType": "git"
},
{
"lessThan": "fe93e907b1af03cc229a80aa64a570a103d2b279",
"status": "affected",
"version": "9b671f6f432be07c0ddd66e437d6d0e0db684f83",
"versionType": "git"
},
{
"lessThan": "48125cd9c55cbe297b59fd1f9bda48b0960bd181",
"status": "affected",
"version": "8ce720d5bd91e9dc16db3604aa4b1bf76770a9a1",
"versionType": "git"
},
{
"lessThan": "c2ff4764e03e7a8d758352f4aceb8fe1be6ac971",
"status": "affected",
"version": "8ce720d5bd91e9dc16db3604aa4b1bf76770a9a1",
"versionType": "git"
},
{
"lessThan": "5.10.259",
"status": "affected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThan": "5.15.210",
"status": "affected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThan": "6.1.176",
"status": "affected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThan": "6.6.143",
"status": "affected",
"version": "6.6.127",
"versionType": "semver"
},
{
"lessThan": "6.12.93",
"status": "affected",
"version": "6.12.74",
"versionType": "semver"
},
{
"lessThan": "6.18.35",
"status": "affected",
"version": "6.18.13",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/include/asm/tlb.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.10.253",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.15.203",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "6.1.167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.6.127",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "6.12.74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "6.18.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: tlb: Flush walk cache when unsharing PMD tables\n\nWhen huge_pmd_unshare() is called to unshare a PMD table, the\ntlb_unshare_pmd_ptdesc() function sets tlb-\u003eunshared_tables=true\nbut the aarch64 tlb_flush() only checked tlb-\u003efreed_tables to\ndetermine whether to use TLBF_NONE (vae1is, invalidates walk\ncache) or TLBF_NOWALKCACHE (vale1is, leaf-only).\n\nThis caused the stale PMD page table entry to remain in the walk cache\nafter unshare, potentially leading to incorrect page table walks.\n\nFix by including unshared_tables in the check, so that when\nunsharing tables, TLBF_NONE is used and the walk cache is properly\ninvalidated.\n\nHere is the detailed distinction between vae1is and vale1is:\n\n| Instruction Combination | Actual Invalidation Scope |\n| ------------------------ | --------------------------------------------------|\n| `VAE1IS` + TTL=`0` | All entries at all levels (full invalidation) |\n| `VAE1IS` + TTL=`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2 |\n| `VALE1IS` + TTL=`0` | Leaf entries at all levels (non-leaf not cleared) |\n| `VALE1IS` + TTL=`2` (L2) | Leaf entry at Level 2 only |"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable `tlb_flush()` path is only reached through local memory-management syscalls (mmap/munmap/mprotect/mremap/fork) operating on hugetlb VMAs, not through any network-facing kernel service.\nAC:L - An attacker fully controls the trigger sequence\u2014creating shared hugetlbfs mappings (\u22651GB PUD-aligned), forking to establish shared PMD tables, and concurrently unmapping/mprotecting/mremapping to force `huge_pmd_unshare()`\u2014with no conditions outside their control.\nPR:L - Exploitation requires only an unprivileged local user capable of mapping shared hugetlb pages via hugetlbfs or SHM_HUGETLB, which is commonly available on arm64 database and container hosts with pre-reserved huge pages.\nUI:N - No victim interaction is required; the attacker sets up and triggers the stale walk-cache condition entirely within processes they control.\nS:U - Impact is confined to kernel memory-management within the same security authority (incorrect page-table walks and cross-mapping leakage within the kernel), not a VM escape or cross-authority boundary break.\nC:H - Stale non-leaf walk-cache entries after `pud_clear()` can cause incorrect page-table walks, enabling reads of memory that should be unmapped or mapped to different physical pages, constituting an arbitrary memory read primitive.\nI:H - Incorrect translations from stale PMD walk-cache entries can direct stores to unintended physical pages, and freed/reused page-table pages reached via stale cache entries provide a write/corruption primitive exploitable for control-flow hijacking.\nA:H - Stale walk-cache pointers to cleared or freed page-table structures can cause kernel faults, oops, or panics during page walks or concurrent GUP-fast access on the affected address space."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:36:48.899Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dced308d7d6a0de1c09d2058f38f1aaaf5cbb914"
},
{
"url": "https://git.kernel.org/stable/c/47490bbb05c8c0e09cc3cfd237d8934ffc340583"
},
{
"url": "https://git.kernel.org/stable/c/0199c9d57861f17b556b6cba1f765c7cce79745b"
},
{
"url": "https://git.kernel.org/stable/c/d766a49d9b55705c4737cd8bb5d3faa2d31330fd"
},
{
"url": "https://git.kernel.org/stable/c/8ca7284da0e67b3e71d90ec17f08286774245ad9"
},
{
"url": "https://git.kernel.org/stable/c/fe93e907b1af03cc229a80aa64a570a103d2b279"
},
{
"url": "https://git.kernel.org/stable/c/48125cd9c55cbe297b59fd1f9bda48b0960bd181"
},
{
"url": "https://git.kernel.org/stable/c/c2ff4764e03e7a8d758352f4aceb8fe1be6ac971"
}
],
"title": "arm64: tlb: Flush walk cache when unsharing PMD tables",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63875",
"datePublished": "2026-07-19T14:54:48.842Z",
"dateReserved": "2026-07-19T07:54:57.017Z",
"dateUpdated": "2026-10-19T20:17:53.723Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64534 (GCVE-0-2026-64534)
Vulnerability from cvelistv5
Published
2026-07-27 06:32
Modified
2026-10-19 20:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected,
nvmet_req_uninit() is called unconditionally. However, if the command
arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init()
had returned false and percpu_ref_tryget_live() was never executed. The
unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a
refcount underflow, leading to a WARNING in
percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and
eventually a permanent workqueue deadlock.
Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling
nvmet_req_uninit(), matching the existing pattern in
nvmet_tcp_execute_request().
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 91edfca6f8b364d60cde3ddefaf7d03ddf35774b Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: 4b17476d809273617d3317fa0d4ae78aa488d760 Version: 5.10.20 ≤ Version: 5.11.3 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64534",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:41:53.789221Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-667",
"description": "CWE-667 Improper Locking",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:48:38.863Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "22ec7a9fe9153d2737ee9b2fa6d2e43a1491decf",
"status": "affected",
"version": "91edfca6f8b364d60cde3ddefaf7d03ddf35774b",
"versionType": "git"
},
{
"lessThan": "ba35b1c674ca3841c0dfadd698f2c1b3ec542d4e",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"lessThan": "c7874dad84b20433c0fe3919f291a762d40de08b",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"lessThan": "e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"lessThan": "d306da8833e75f669d93424fd84940236f3850bc",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"lessThan": "2ed3c9d955e8cd6361f130623baa664a75fb345f",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"lessThan": "4606467a75cfc16721937272ed29462a750b60c8",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"status": "affected",
"version": "4b17476d809273617d3317fa0d4ae78aa488d760",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "5.10.20",
"versionType": "semver"
},
{
"lessThan": "5.12",
"status": "affected",
"version": "5.11.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path\n\nIn nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected,\nnvmet_req_uninit() is called unconditionally. However, if the command\narrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init()\nhad returned false and percpu_ref_tryget_live() was never executed. The\nunconditional percpu_ref_put() inside nvmet_req_uninit() then causes a\nrefcount underflow, leading to a WARNING in\npercpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and\neventually a permanent workqueue deadlock.\n\nCheck cmd-\u003eflags \u0026 NVMET_TCP_F_INIT_FAILED before calling\nnvmet_req_uninit(), matching the existing pattern in\nnvmet_tcp_execute_request()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable NVMe/TCP target receive path processes attacker-supplied ICReq, CapsuleCmd, inline payload, and digest data over an Internet-routable TCP connection.\nAC:L - The attacker can negotiate data digests and reliably send a rejected write command with inline data followed by an incorrect digest; no race or condition outside the attacker\u0027s control is required.\nPR:N - A malformed CapsuleCmd can trigger this path before CONNECT, host-NQN ACL evaluation, or DH-HMAC-CHAP authentication, so the remote attacker needs no credentials or privileges.\nUI:N - The target processes the malicious protocol sequence automatically without any victim action.\nS:U - The vulnerable transport and the affected kernel memory, execution, and storage resources belong to the same target-host security authority.\nC:H - The unmatched reference decrement can offset a legitimate in-flight request reference, allowing command structures and SGL pages to be freed while backend I/O still uses them; this UAF can expose arbitrary reused kernel memory.\nI:H - The premature freeing of request structures and I/O pages can let backend operations write through reallocated memory or corrupt completion control state, making arbitrary kernel writes and control-flow hijacking defensible.\nA:H - The basic trigger causes a submission-queue refcount underflow and permanent workqueue deadlock, while UAF variants can crash the kernel; unauthenticated attackers can repeat the trigger across connections."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:42:44.214Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/22ec7a9fe9153d2737ee9b2fa6d2e43a1491decf"
},
{
"url": "https://git.kernel.org/stable/c/ba35b1c674ca3841c0dfadd698f2c1b3ec542d4e"
},
{
"url": "https://git.kernel.org/stable/c/c7874dad84b20433c0fe3919f291a762d40de08b"
},
{
"url": "https://git.kernel.org/stable/c/e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1"
},
{
"url": "https://git.kernel.org/stable/c/d306da8833e75f669d93424fd84940236f3850bc"
},
{
"url": "https://git.kernel.org/stable/c/2ed3c9d955e8cd6361f130623baa664a75fb345f"
},
{
"url": "https://git.kernel.org/stable/c/4606467a75cfc16721937272ed29462a750b60c8"
}
],
"title": "nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64534",
"datePublished": "2026-07-27T06:32:34.301Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-10-19T20:48:38.863Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22977 (GCVE-0-2026-22977)
Vulnerability from cvelistv5
Published
2026-01-21 13:08
Modified
2026-10-19 18:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: sock: fix hardened usercopy panic in sock_recv_errqueue
skbuff_fclone_cache was created without defining a usercopy region,
[1] unlike skbuff_head_cache which properly whitelists the cb[] field.
[2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is
enabled and the kernel attempts to copy sk_buff.cb data to userspace
via sock_recv_errqueue() -> put_cmsg().
The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone()
(from skbuff_fclone_cache) [1]
2. The skb is cloned via skb_clone() using the pre-allocated fclone
[3] 3. The cloned skb is queued to sk_error_queue for timestamp
reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE)
5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb
[4] 6. __check_heap_object() fails because skbuff_fclone_cache has no
usercopy whitelist [5]
When cloned skbs allocated from skbuff_fclone_cache are used in the
socket error queue, accessing the sock_exterr_skb structure in skb->cb
via put_cmsg() triggers a usercopy hardening violation:
[ 5.379589] usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_fclone_cache' (offset 296, size 16)!
[ 5.382796] kernel BUG at mm/usercopy.c:102!
[ 5.383923] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
[ 5.384903] CPU: 1 UID: 0 PID: 138 Comm: poc_put_cmsg Not tainted 6.12.57 #7
[ 5.384903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 5.384903] RIP: 0010:usercopy_abort+0x6c/0x80
[ 5.384903] Code: 1a 86 51 48 c7 c2 40 15 1a 86 41 52 48 c7 c7 c0 15 1a 86 48 0f 45 d6 48 c7 c6 80 15 1a 86 48 89 c1 49 0f 45 f3 e8 84 27 88 ff <0f> 0b 490
[ 5.384903] RSP: 0018:ffffc900006f77a8 EFLAGS: 00010246
[ 5.384903] RAX: 000000000000006f RBX: ffff88800f0ad2a8 RCX: 1ffffffff0f72e74
[ 5.384903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87b973a0
[ 5.384903] RBP: 0000000000000010 R08: 0000000000000000 R09: fffffbfff0f72e74
[ 5.384903] R10: 0000000000000003 R11: 79706f6372657375 R12: 0000000000000001
[ 5.384903] R13: ffff88800f0ad2b8 R14: ffffea00003c2b40 R15: ffffea00003c2b00
[ 5.384903] FS: 0000000011bc4380(0000) GS:ffff8880bf100000(0000) knlGS:0000000000000000
[ 5.384903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 5.384903] CR2: 000056aa3b8e5fe4 CR3: 000000000ea26004 CR4: 0000000000770ef0
[ 5.384903] PKRU: 55555554
[ 5.384903] Call Trace:
[ 5.384903] <TASK>
[ 5.384903] __check_heap_object+0x9a/0xd0
[ 5.384903] __check_object_size+0x46c/0x690
[ 5.384903] put_cmsg+0x129/0x5e0
[ 5.384903] sock_recv_errqueue+0x22f/0x380
[ 5.384903] tls_sw_recvmsg+0x7ed/0x1960
[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
[ 5.384903] ? schedule+0x6d/0x270
[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
[ 5.384903] ? mutex_unlock+0x81/0xd0
[ 5.384903] ? __pfx_mutex_unlock+0x10/0x10
[ 5.384903] ? __pfx_tls_sw_recvmsg+0x10/0x10
[ 5.384903] ? _raw_spin_lock_irqsave+0x8f/0xf0
[ 5.384903] ? _raw_read_unlock_irqrestore+0x20/0x40
[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
The crash offset 296 corresponds to skb2->cb within skbuff_fclones:
- sizeof(struct sk_buff) = 232 - offsetof(struct sk_buff, cb) = 40 -
offset of skb2.cb in fclones = 232 + 40 = 272 - crash offset 296 =
272 + 24 (inside sock_exterr_skb.ee)
This patch uses a local stack variable as a bounce buffer to avoid the hardened usercopy check failure.
[1] https://elixir.bootlin.com/linux/v6.12.62/source/net/ipv4/tcp.c#L885
[2] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5104
[3] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5566
[4] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5491
[5] https://elixir.bootlin.com/linux/v6.12.62/source/mm/slub.c#L5719
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6d07d1cd300f4c7e16005f881fea388164999cc8 Version: 6d07d1cd300f4c7e16005f881fea388164999cc8 Version: 6d07d1cd300f4c7e16005f881fea388164999cc8 Version: 6d07d1cd300f4c7e16005f881fea388164999cc8 Version: 6d07d1cd300f4c7e16005f881fea388164999cc8 Version: 6d07d1cd300f4c7e16005f881fea388164999cc8 Version: 6d07d1cd300f4c7e16005f881fea388164999cc8 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RST2428P",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:12:23.081Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22977",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-10T20:41:47.988660Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:25:25.873Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "88dd6be7ebb3153b662c2cebcb06e032a92857f5",
"status": "affected",
"version": "6d07d1cd300f4c7e16005f881fea388164999cc8",
"versionType": "git"
},
{
"lessThan": "c655d2167bf014d4c61b4faeca59b60ff9b9f6b1",
"status": "affected",
"version": "6d07d1cd300f4c7e16005f881fea388164999cc8",
"versionType": "git"
},
{
"lessThan": "8c6901aa29626e35045130bac09b75f791acca85",
"status": "affected",
"version": "6d07d1cd300f4c7e16005f881fea388164999cc8",
"versionType": "git"
},
{
"lessThan": "582a5e922a9652fcbb7d0165c95d5b20aa37575d",
"status": "affected",
"version": "6d07d1cd300f4c7e16005f881fea388164999cc8",
"versionType": "git"
},
{
"lessThan": "005671c60fcf1dbdb8bddf12a62568fd5e4ec391",
"status": "affected",
"version": "6d07d1cd300f4c7e16005f881fea388164999cc8",
"versionType": "git"
},
{
"lessThan": "e00b169eaac5f7cdbf710c354c8fa76d02009115",
"status": "affected",
"version": "6d07d1cd300f4c7e16005f881fea388164999cc8",
"versionType": "git"
},
{
"lessThan": "2a71a1a8d0ed718b1c7a9ac61f07e5755c47ae20",
"status": "affected",
"version": "6d07d1cd300f4c7e16005f881fea388164999cc8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.248",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.198",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.121",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.66",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.248",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.198",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.161",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.121",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.66",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.6",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sock: fix hardened usercopy panic in sock_recv_errqueue\n\nskbuff_fclone_cache was created without defining a usercopy region,\n[1] unlike skbuff_head_cache which properly whitelists the cb[] field.\n[2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is\nenabled and the kernel attempts to copy sk_buff.cb data to userspace\nvia sock_recv_errqueue() -\u003e put_cmsg().\n\nThe crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone()\n (from skbuff_fclone_cache) [1]\n2. The skb is cloned via skb_clone() using the pre-allocated fclone\n[3] 3. The cloned skb is queued to sk_error_queue for timestamp\nreporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE)\n5. sock_recv_errqueue() calls put_cmsg() to copy serr-\u003eee from skb-\u003ecb\n[4] 6. __check_heap_object() fails because skbuff_fclone_cache has no\n usercopy whitelist [5]\n\nWhen cloned skbs allocated from skbuff_fclone_cache are used in the\nsocket error queue, accessing the sock_exterr_skb structure in skb-\u003ecb\nvia put_cmsg() triggers a usercopy hardening violation:\n\n[ 5.379589] usercopy: Kernel memory exposure attempt detected from SLUB object \u0027skbuff_fclone_cache\u0027 (offset 296, size 16)!\n[ 5.382796] kernel BUG at mm/usercopy.c:102!\n[ 5.383923] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n[ 5.384903] CPU: 1 UID: 0 PID: 138 Comm: poc_put_cmsg Not tainted 6.12.57 #7\n[ 5.384903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[ 5.384903] RIP: 0010:usercopy_abort+0x6c/0x80\n[ 5.384903] Code: 1a 86 51 48 c7 c2 40 15 1a 86 41 52 48 c7 c7 c0 15 1a 86 48 0f 45 d6 48 c7 c6 80 15 1a 86 48 89 c1 49 0f 45 f3 e8 84 27 88 ff \u003c0f\u003e 0b 490\n[ 5.384903] RSP: 0018:ffffc900006f77a8 EFLAGS: 00010246\n[ 5.384903] RAX: 000000000000006f RBX: ffff88800f0ad2a8 RCX: 1ffffffff0f72e74\n[ 5.384903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87b973a0\n[ 5.384903] RBP: 0000000000000010 R08: 0000000000000000 R09: fffffbfff0f72e74\n[ 5.384903] R10: 0000000000000003 R11: 79706f6372657375 R12: 0000000000000001\n[ 5.384903] R13: ffff88800f0ad2b8 R14: ffffea00003c2b40 R15: ffffea00003c2b00\n[ 5.384903] FS: 0000000011bc4380(0000) GS:ffff8880bf100000(0000) knlGS:0000000000000000\n[ 5.384903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 5.384903] CR2: 000056aa3b8e5fe4 CR3: 000000000ea26004 CR4: 0000000000770ef0\n[ 5.384903] PKRU: 55555554\n[ 5.384903] Call Trace:\n[ 5.384903] \u003cTASK\u003e\n[ 5.384903] __check_heap_object+0x9a/0xd0\n[ 5.384903] __check_object_size+0x46c/0x690\n[ 5.384903] put_cmsg+0x129/0x5e0\n[ 5.384903] sock_recv_errqueue+0x22f/0x380\n[ 5.384903] tls_sw_recvmsg+0x7ed/0x1960\n[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 5.384903] ? schedule+0x6d/0x270\n[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 5.384903] ? mutex_unlock+0x81/0xd0\n[ 5.384903] ? __pfx_mutex_unlock+0x10/0x10\n[ 5.384903] ? __pfx_tls_sw_recvmsg+0x10/0x10\n[ 5.384903] ? _raw_spin_lock_irqsave+0x8f/0xf0\n[ 5.384903] ? _raw_read_unlock_irqrestore+0x20/0x40\n[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5\n\nThe crash offset 296 corresponds to skb2-\u003ecb within skbuff_fclones:\n - sizeof(struct sk_buff) = 232 - offsetof(struct sk_buff, cb) = 40 -\n offset of skb2.cb in fclones = 232 + 40 = 272 - crash offset 296 =\n 272 + 24 (inside sock_exterr_skb.ee)\n\nThis patch uses a local stack variable as a bounce buffer to avoid the hardened usercopy check failure.\n\n[1] https://elixir.bootlin.com/linux/v6.12.62/source/net/ipv4/tcp.c#L885\n[2] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5104\n[3] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5566\n[4] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5491\n[5] https://elixir.bootlin.com/linux/v6.12.62/source/mm/slub.c#L5719"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T21:57:36.693Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/88dd6be7ebb3153b662c2cebcb06e032a92857f5"
},
{
"url": "https://git.kernel.org/stable/c/c655d2167bf014d4c61b4faeca59b60ff9b9f6b1"
},
{
"url": "https://git.kernel.org/stable/c/8c6901aa29626e35045130bac09b75f791acca85"
},
{
"url": "https://git.kernel.org/stable/c/582a5e922a9652fcbb7d0165c95d5b20aa37575d"
},
{
"url": "https://git.kernel.org/stable/c/005671c60fcf1dbdb8bddf12a62568fd5e4ec391"
},
{
"url": "https://git.kernel.org/stable/c/e00b169eaac5f7cdbf710c354c8fa76d02009115"
},
{
"url": "https://git.kernel.org/stable/c/2a71a1a8d0ed718b1c7a9ac61f07e5755c47ae20"
}
],
"title": "net: sock: fix hardened usercopy panic in sock_recv_errqueue",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-22977",
"datePublished": "2026-01-21T13:08:54.858Z",
"dateReserved": "2026-01-13T15:37:45.935Z",
"dateUpdated": "2026-10-19T18:25:25.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74752 (GCVE-0-2026-74752)
Vulnerability from cvelistv5
Published
2026-08-26 14:36
Modified
2026-10-21 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate cookie AUTH state before use
When cookie authentication is disabled, COOKIE_ECHO restores fixed-size
AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM
length, HMAC list, or CHUNKS list can then reach association consumers
with lengths or identifiers that were never validated against the local
backing arrays.
A forged RANDOM length can cause out-of-bounds reads during key-vector
construction. A forged HMAC identifier also caused a 32-byte write past
a zero-length AUTH chunk, providing a primitive for a local privilege
escalation chain.
Validate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie
trust boundary before copying them into the association. Reject invalid
types, malformed lengths, unsupported HMAC identifiers, HMAC lists
without SHA1, and forbidden chunk ids.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74752",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:16:25.350604Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:24.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/sctp/auth.h",
"net/sctp/auth.c",
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4a4410de8dc6903d859c9e1731fc6dcee28bd072",
"status": "affected",
"version": "1f485649f52929d9937b346a920a522a7363e202",
"versionType": "git"
},
{
"lessThan": "7f17984cfa697613800eb693e183b06884129bd3",
"status": "affected",
"version": "1f485649f52929d9937b346a920a522a7363e202",
"versionType": "git"
},
{
"lessThan": "88619b117be1daf633ce32210570ce35a0bd1c98",
"status": "affected",
"version": "1f485649f52929d9937b346a920a522a7363e202",
"versionType": "git"
},
{
"lessThan": "3dbb44d88b1e94dd31fe43588af7437b34b44d56",
"status": "affected",
"version": "1f485649f52929d9937b346a920a522a7363e202",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/sctp/auth.h",
"net/sctp/auth.c",
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cookie AUTH state before use\n\nWhen cookie authentication is disabled, COOKIE_ECHO restores fixed-size\nAUTH fields directly from peer-controlled cookie bytes. A forged RANDOM\nlength, HMAC list, or CHUNKS list can then reach association consumers\nwith lengths or identifiers that were never validated against the local\nbacking arrays.\n\nA forged RANDOM length can cause out-of-bounds reads during key-vector\nconstruction. A forged HMAC identifier also caused a 32-byte write past\na zero-length AUTH chunk, providing a primitive for a local privilege\nescalation chain.\n\nValidate the cookie\u0027s RANDOM, HMACS, and CHUNKS parameters at the cookie\ntrust boundary before copying them into the association. Reject invalid\ntypes, malformed lengths, unsupported HMAC identifiers, HMAC lists\nwithout SHA1, and forbidden chunk ids."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached when a remote peer sends SCTP COOKIE-ECHO to a listening endpoint; packets enter sctp_rcv() and are handled in sctp_sf_do_5_1D_ce()/sctp_unpack_cookie() with no local syscall required on the victim.\nAC:L - With SCTP-AUTH enabled and cookie_hmac_alg=none, an attacker completes INIT/INIT-ACK, forges peer-controlled AUTH fields in the returned cookie, and reliably triggers sctp_auth_make_key_vector()/sctp_auth_calculate_hmac() via COOKIE-ECHO without races or uncontrollable conditions.\nPR:N - Exploitation is pre-authentication SCTP handshake processing on a listening server; the attacker only needs network reachability to the SCTP port and does not need local account privileges, capabilities, or init-namespace root on the target host.\nUI:N - No victim user action is required beyond normal SCTP listener operation; exploitation is achieved solely by sending attacker-crafted COOKIE-ECHO packets over the network during association setup or restart.\nS:U - The vulnerability corrupts kernel memory inside the SCTP stack on the target host and enables kernel privilege escalation; it does not cross a separate security boundary such as guest-to-host VM escape or IOMMU/DMA isolation bypass.\nC:H - A forged RANDOM length copied from an unauthenticated cookie drives sctp_auth_make_key_vector() to memcpy() beyond the fixed auth_random backing array, enabling out-of-bounds kernel memory reads during association shared-key construction.\nI:H - Forged HMAC identifiers from the cookie can yield a zero-length AUTH chunk while sctp_auth_calculate_hmac() still writes a 32-byte digest past the allocation, providing a heap overflow primitive the fix commit notes can chain to local privilege escalation.\nA:H - Out-of-bounds reads and the 32-byte heap overflow during COOKIE-ECHO processing can trigger kernel faults, oops, or panic on SCTP servers, and malformed AUTH state can repeatedly crash association input handling."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:46:23.915Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4a4410de8dc6903d859c9e1731fc6dcee28bd072"
},
{
"url": "https://git.kernel.org/stable/c/7f17984cfa697613800eb693e183b06884129bd3"
},
{
"url": "https://git.kernel.org/stable/c/88619b117be1daf633ce32210570ce35a0bd1c98"
},
{
"url": "https://git.kernel.org/stable/c/3dbb44d88b1e94dd31fe43588af7437b34b44d56"
}
],
"title": "sctp: validate cookie AUTH state before use",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74752",
"datePublished": "2026-08-26T14:36:59.548Z",
"dateReserved": "2026-08-15T05:44:03.931Z",
"dateUpdated": "2026-10-21T12:46:23.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80584 (GCVE-0-2026-80584)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-10-16 19:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/qeth: validate user buffer length in SNMP and ARP query ioctls
qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by
a user-supplied length (udata_len) without checking a lower bound, then
set udata_offset to a fixed non-zero value and pass both to a reply
callback. The callback bounds-checks the copy with
if ((udata_len - udata_offset) < len)
Both fields are u32, so a udata_len smaller than udata_offset makes the
subtraction wrap and the check pass, and the following memcpy() writes
past the allocation. A udata_len of 0 also yields ZERO_SIZE_PTR from
kzalloc(), which the existing NULL check does not catch.
Reject buffers smaller than udata_offset before allocating, so the
callback subtraction can no longer underflow.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4a71df50047f0db65ea09b1be155852e81a45eba Version: 4a71df50047f0db65ea09b1be155852e81a45eba Version: 4a71df50047f0db65ea09b1be155852e81a45eba Version: 4a71df50047f0db65ea09b1be155852e81a45eba Version: 4a71df50047f0db65ea09b1be155852e81a45eba Version: 4a71df50047f0db65ea09b1be155852e81a45eba Version: 4a71df50047f0db65ea09b1be155852e81a45eba Version: 4a71df50047f0db65ea09b1be155852e81a45eba |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80584",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:17:53.198738Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:28.329Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/net/qeth_core_main.c",
"drivers/s390/net/qeth_l3_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9d00eeb2d27f4cc817c5e408760226d43f811ec6",
"status": "affected",
"version": "4a71df50047f0db65ea09b1be155852e81a45eba",
"versionType": "git"
},
{
"lessThan": "46443eaddebd84c51940857b11787229be169dec",
"status": "affected",
"version": "4a71df50047f0db65ea09b1be155852e81a45eba",
"versionType": "git"
},
{
"lessThan": "91935843f9396a9e45253e2c0d4337ca1371754b",
"status": "affected",
"version": "4a71df50047f0db65ea09b1be155852e81a45eba",
"versionType": "git"
},
{
"lessThan": "cc423f4105fe145b33e1d7cad34245a798358f73",
"status": "affected",
"version": "4a71df50047f0db65ea09b1be155852e81a45eba",
"versionType": "git"
},
{
"lessThan": "3083818e67bcd656965797fbac9a3d6c1d44f78a",
"status": "affected",
"version": "4a71df50047f0db65ea09b1be155852e81a45eba",
"versionType": "git"
},
{
"lessThan": "a3083647747942ea32faf14560d6397ff3068046",
"status": "affected",
"version": "4a71df50047f0db65ea09b1be155852e81a45eba",
"versionType": "git"
},
{
"lessThan": "75fb3151513d7d9f77a8f9545418279b119c06b8",
"status": "affected",
"version": "4a71df50047f0db65ea09b1be155852e81a45eba",
"versionType": "git"
},
{
"lessThan": "d141f087b1af656f055d7c5793a3e87817ba0bbe",
"status": "affected",
"version": "4a71df50047f0db65ea09b1be155852e81a45eba",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/net/qeth_core_main.c",
"drivers/s390/net/qeth_l3_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/qeth: validate user buffer length in SNMP and ARP query ioctls\n\nqeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by\na user-supplied length (udata_len) without checking a lower bound, then\nset udata_offset to a fixed non-zero value and pass both to a reply\ncallback. The callback bounds-checks the copy with\n\n if ((udata_len - udata_offset) \u003c len)\n\nBoth fields are u32, so a udata_len smaller than udata_offset makes the\nsubtraction wrap and the check pass, and the following memcpy() writes\npast the allocation. A udata_len of 0 also yields ZERO_SIZE_PTR from\nkzalloc(), which the existing NULL check does not catch.\n\nReject buffers smaller than udata_offset before allocating, so the\ncallback subtraction can no longer underflow."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires a local ioctl(2) on a qeth netdev (SIOC_QETH_ADP_SET_SNMP_CONTROL or SIOC_QETH_ARP_QUERY_INFO) via socket()-\u003edev_ioctl()-\u003edev_siocdevprivate(); no remote packet or network protocol handler reaches these code paths.\nAC:L - The attacker fully controls udata_len in the ioctl argument; values below the fixed udata_offset (16 for SNMP, 6 for ARP) deterministically underflow the u32 bounds check and cause memcpy() past the kmalloc allocation without races or uncontrollable memory layout.\nPR:N - On affected kernels before CVE-2026-74467, SIOC_QETH_ADP_SET_SNMP_CONTROL had no CAP_NET_ADMIN gate and dev_ioctl() performs no capability check for SIOCDEVPRIVATE, so any unprivileged local user on an IBM Z/LinuxONE LPAR with a qeth interface can reach the overflow.\nUI:N - Exploitation requires only the attacker opening a socket and issuing the crafted ioctl against a qeth interface; no victim login, mount, or other interactive action is needed on a shared mainframe guest.\nS:U - Impact is kernel heap corruption and crash within the local LPAR/kernel security boundary on IBM Z; this does not cross a VM guest-to-host, container, or IOMMU security boundary.\nC:H - The unchecked memcpy() performs a kernel heap out-of-bounds write past a user-sized kmalloc buffer, corrupting adjacent slab objects; per CNA guidance, memory corruption exploitable for information disclosure warrants High confidentiality impact.\nI:H - Integer underflow bypasses the bounds check and memcpy() writes OSA SNMP/ARP response data past the kmalloc allocation end, providing a kernel heap overflow primitive suitable for adjacent-object corruption and privilege escalation.\nA:H - udata_len=0 yields ZERO_SIZE_PTR from kzalloc() (not caught by the NULL check) and memcpy() writes to a fixed low kernel address causing a CPU fault; undersized non-zero lengths corrupt the heap and can trigger kernel oops or panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:02:04.879Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9d00eeb2d27f4cc817c5e408760226d43f811ec6"
},
{
"url": "https://git.kernel.org/stable/c/46443eaddebd84c51940857b11787229be169dec"
},
{
"url": "https://git.kernel.org/stable/c/91935843f9396a9e45253e2c0d4337ca1371754b"
},
{
"url": "https://git.kernel.org/stable/c/cc423f4105fe145b33e1d7cad34245a798358f73"
},
{
"url": "https://git.kernel.org/stable/c/3083818e67bcd656965797fbac9a3d6c1d44f78a"
},
{
"url": "https://git.kernel.org/stable/c/a3083647747942ea32faf14560d6397ff3068046"
},
{
"url": "https://git.kernel.org/stable/c/75fb3151513d7d9f77a8f9545418279b119c06b8"
},
{
"url": "https://git.kernel.org/stable/c/d141f087b1af656f055d7c5793a3e87817ba0bbe"
}
],
"title": "s390/qeth: validate user buffer length in SNMP and ARP query ioctls",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80584",
"datePublished": "2026-08-26T14:37:40.302Z",
"dateReserved": "2026-08-26T14:34:25.769Z",
"dateUpdated": "2026-10-16T19:26:28.329Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63987 (GCVE-0-2026-63987)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-10-19 20:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
ethnl_update_profile() walks the ETHTOOL_A_PROFILE_IRQ_MODERATION
nest list with an index 'i' and writes new_profile[i++] without
bounding i. The destination is kmemdup()'d at NET_DIM_PARAMS_NUM_PROFILES
entries (5), but the Netlink nest count is entirely user-controlled.
Netlink policies do not have support for constraining the number
of nested entries (or number of multi-attr entries).
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63987",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:34:43.913131Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:18:01.044Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ethtool/coalesce.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d4c9cc7c47781c6f4fa29d80a1193a8bcd1525bc",
"status": "affected",
"version": "f750dfe825b904164688adeb147950e0e0c4d262",
"versionType": "git"
},
{
"lessThan": "0c02c190bcd9822477038ff2cee10ea584ac1b1d",
"status": "affected",
"version": "f750dfe825b904164688adeb147950e0e0c4d262",
"versionType": "git"
},
{
"lessThan": "6205f7166d2dd14a017a5802c81e5bd1421a8635",
"status": "affected",
"version": "f750dfe825b904164688adeb147950e0e0c4d262",
"versionType": "git"
},
{
"lessThan": "7281b096b072f6c6e30420e3467d738f2e4c4b57",
"status": "affected",
"version": "f750dfe825b904164688adeb147950e0e0c4d262",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ethtool/coalesce.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES\n\nethnl_update_profile() walks the ETHTOOL_A_PROFILE_IRQ_MODERATION\nnest list with an index \u0027i\u0027 and writes new_profile[i++] without\nbounding i. The destination is kmemdup()\u0027d at NET_DIM_PARAMS_NUM_PROFILES\nentries (5), but the Netlink nest count is entirely user-controlled.\nNetlink policies do not have support for constraining the number\nof nested entries (or number of multi-attr entries)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through the ETHTOOL_MSG_COALESCE_SET generic-netlink ioctl path (ethnl_default_set_doit \u2192 ethnl_set_coalesce \u2192 ethnl_update_profile), not via remote network packets or physical bus access.\nAC:L - An attacker with CAP_NET_ADMIN can send a crafted netlink message with more than five nested ETHTOOL_A_PROFILE_IRQ_MODERATION attributes and deterministically trigger a heap buffer overflow past the five-entry kmemdup buffer.\nPR:L - ETHTOOL_MSG_COALESCE_SET is gated by GENL_UNS_ADMIN_PERM, which requires CAP_NET_ADMIN in the socket\u0027s network namespace user namespace; this capability is obtainable by an unprivileged user via user namespaces (unshare -Urn) or containers granted NET_ADMIN (e.g., hostNetwork pods).\nUI:N - Exploitation requires only the attacker\u0027s own ethtool netlink SET_COALESCE request with a malformed profile nest; no action by another user or victim is needed.\nS:U - The vulnerability corrupts kernel heap memory within the same kernel security domain; it does not by itself cross a VM, container, or IOMMU boundary to affect a separate security authority.\nC:H - The out-of-bounds writes past the 120-byte (5 \u00d7 24-byte dim_cq_moder) kmalloc allocation can corrupt adjacent slab objects, providing a standard heap-corruption primitive that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The attacker fully controls the overflowed u16 profile fields (usec, pkts, comps) written beyond the allocation boundary, enabling heap metadata or adjacent-object corruption that can be developed into arbitrary kernel write or code execution.\nA:H - Heap corruption from unbounded profile indexing can cause immediate kernel oops/panic during the write or when the corrupted profile is subsequently used by DIM/virtio-net interrupt moderation paths."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:54.593Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d4c9cc7c47781c6f4fa29d80a1193a8bcd1525bc"
},
{
"url": "https://git.kernel.org/stable/c/0c02c190bcd9822477038ff2cee10ea584ac1b1d"
},
{
"url": "https://git.kernel.org/stable/c/6205f7166d2dd14a017a5802c81e5bd1421a8635"
},
{
"url": "https://git.kernel.org/stable/c/7281b096b072f6c6e30420e3467d738f2e4c4b57"
}
],
"title": "ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63987",
"datePublished": "2026-07-19T14:56:08.940Z",
"dateReserved": "2026-07-19T07:54:57.025Z",
"dateUpdated": "2026-10-19T20:18:01.044Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46086 (GCVE-0-2026-46086)
Vulnerability from cvelistv5
Published
2026-05-27 12:58
Modified
2026-11-06 16:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: use a stable FDB dst snapshot in RCU readers
Local FDB entries can be rewritten in place by `fdb_delete_local()`, which
updates `f->dst` to another port or to `NULL` while keeping the entry
alive. Several bridge RCU readers inspect `f->dst`, including
`br_fdb_fillbuf()` through the `brforward_read()` sysfs path.
These readers currently load `f->dst` multiple times and can therefore
observe inconsistent values across the check and later dereference.
In `br_fdb_fillbuf()`, this means a concurrent local-FDB update can change
`f->dst` after the NULL check and before the `port_no` dereference,
leading to a NULL-ptr-deref.
Fix this by taking a single `READ_ONCE()` snapshot of `f->dst` in each
affected RCU reader and using that snapshot for the rest of the access
sequence. Also publish the in-place `f->dst` updates in `fdb_delete_local()`
with `WRITE_ONCE()` so the readers and writer use matching access patterns.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 960b589f86c74ce582922fcb996103271081f4de Version: 960b589f86c74ce582922fcb996103271081f4de Version: 960b589f86c74ce582922fcb996103271081f4de Version: 960b589f86c74ce582922fcb996103271081f4de Version: 960b589f86c74ce582922fcb996103271081f4de Version: 960b589f86c74ce582922fcb996103271081f4de Version: 960b589f86c74ce582922fcb996103271081f4de Version: 960b589f86c74ce582922fcb996103271081f4de |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:20:24.801Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46086",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:07:53.882222Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:13:36.882Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/br_arp_nd_proxy.c",
"net/bridge/br_fdb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c502fa9f094cb03d1d1685c71e2105ab359bc2b8",
"status": "affected",
"version": "960b589f86c74ce582922fcb996103271081f4de",
"versionType": "git"
},
{
"lessThan": "a6ae4511c07b91f597e461406c6330f0d4ff810e",
"status": "affected",
"version": "960b589f86c74ce582922fcb996103271081f4de",
"versionType": "git"
},
{
"lessThan": "1406c4e0ed1eaf8a29801ab1163d00fb7ee4359a",
"status": "affected",
"version": "960b589f86c74ce582922fcb996103271081f4de",
"versionType": "git"
},
{
"lessThan": "0b9e4bbfb7c949151e3acd44ed4aa33614d2e110",
"status": "affected",
"version": "960b589f86c74ce582922fcb996103271081f4de",
"versionType": "git"
},
{
"lessThan": "81af4137a30c4c2dc694dea8cacb180bd66000ef",
"status": "affected",
"version": "960b589f86c74ce582922fcb996103271081f4de",
"versionType": "git"
},
{
"lessThan": "5424e678f9b304e148cf5dcc047cffc7a56a3bb5",
"status": "affected",
"version": "960b589f86c74ce582922fcb996103271081f4de",
"versionType": "git"
},
{
"lessThan": "9a2d9d4e657b23dc21f24cf139e3aeff0b61341f",
"status": "affected",
"version": "960b589f86c74ce582922fcb996103271081f4de",
"versionType": "git"
},
{
"lessThan": "df4601653201de21b487c3e7fffd464790cab808",
"status": "affected",
"version": "960b589f86c74ce582922fcb996103271081f4de",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/br_arp_nd_proxy.c",
"net/bridge/br_fdb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.14"
},
{
"lessThan": "3.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: use a stable FDB dst snapshot in RCU readers\n\nLocal FDB entries can be rewritten in place by `fdb_delete_local()`, which\nupdates `f-\u003edst` to another port or to `NULL` while keeping the entry\nalive. Several bridge RCU readers inspect `f-\u003edst`, including\n`br_fdb_fillbuf()` through the `brforward_read()` sysfs path.\n\nThese readers currently load `f-\u003edst` multiple times and can therefore\nobserve inconsistent values across the check and later dereference.\nIn `br_fdb_fillbuf()`, this means a concurrent local-FDB update can change\n`f-\u003edst` after the NULL check and before the `port_no` dereference,\nleading to a NULL-ptr-deref.\n\nFix this by taking a single `READ_ONCE()` snapshot of `f-\u003edst` in each\naffected RCU reader and using that snapshot for the rest of the access\nsequence. Also publish the in-place `f-\u003edst` updates in `fdb_delete_local()`\nwith `WRITE_ONCE()` so the readers and writer use matching access patterns."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-19T11:59:23.674Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c502fa9f094cb03d1d1685c71e2105ab359bc2b8"
},
{
"url": "https://git.kernel.org/stable/c/a6ae4511c07b91f597e461406c6330f0d4ff810e"
},
{
"url": "https://git.kernel.org/stable/c/1406c4e0ed1eaf8a29801ab1163d00fb7ee4359a"
},
{
"url": "https://git.kernel.org/stable/c/0b9e4bbfb7c949151e3acd44ed4aa33614d2e110"
},
{
"url": "https://git.kernel.org/stable/c/81af4137a30c4c2dc694dea8cacb180bd66000ef"
},
{
"url": "https://git.kernel.org/stable/c/5424e678f9b304e148cf5dcc047cffc7a56a3bb5"
},
{
"url": "https://git.kernel.org/stable/c/9a2d9d4e657b23dc21f24cf139e3aeff0b61341f"
},
{
"url": "https://git.kernel.org/stable/c/df4601653201de21b487c3e7fffd464790cab808"
}
],
"title": "net: bridge: use a stable FDB dst snapshot in RCU readers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46086",
"datePublished": "2026-05-27T12:58:28.137Z",
"dateReserved": "2026-05-13T15:03:33.096Z",
"dateUpdated": "2026-11-06T16:13:36.882Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64319 (GCVE-0-2026-64319)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-10-30 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: validate reply message payload bounds against transfer length
nvmet_auth_reply() accesses the variable-length rval[] array using
attacker-controlled hl (hash length) and dhvlen (DH value length) fields
without verifying they fit within the allocated buffer of tl bytes.
A malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a
small transfer length but large hl/dhvlen values, causing out-of-bounds
heap reads when the target processes the DH public key (rval + 2*hl) or
performs the host response memcmp.
With DH authentication configured, the OOB pointer is passed directly to
sg_init_one() and read by crypto_kpp_compute_shared_secret(), reaching
up to 526 bytes past the buffer. This is exploitable pre-authentication.
Add bounds validation ensuring sizeof(*data) + 2*hl + dhvlen <= tl before
any access to the variable-length fields.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: db1312dd95488b5e6ff362ff66fcf953a46b1821 Version: db1312dd95488b5e6ff362ff66fcf953a46b1821 Version: db1312dd95488b5e6ff362ff66fcf953a46b1821 Version: db1312dd95488b5e6ff362ff66fcf953a46b1821 Version: db1312dd95488b5e6ff362ff66fcf953a46b1821 Version: db1312dd95488b5e6ff362ff66fcf953a46b1821 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64319",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:39:00.486358Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:23.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/fabrics-cmd-auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "04fb6ff8b87a0ffff3860ff52bdb2fd04b31ece5",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "80cd28b56ab62d3e7ed0a7bf05282e6d3ee5b2a0",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "999f6205ede984a786f35f727b01f971b98e215d",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "6d7649c1231dac14d906985d2936967e23041c26",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "caa71b3a43ea5c13fe7141cb019ebcb03b8ac857",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "3a413ece2504c70aa34a20be4dafec04e8c741f9",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/fabrics-cmd-auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: validate reply message payload bounds against transfer length\n\nnvmet_auth_reply() accesses the variable-length rval[] array using\nattacker-controlled hl (hash length) and dhvlen (DH value length) fields\nwithout verifying they fit within the allocated buffer of tl bytes.\n\nA malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a\nsmall transfer length but large hl/dhvlen values, causing out-of-bounds\nheap reads when the target processes the DH public key (rval + 2*hl) or\nperforms the host response memcmp.\n\nWith DH authentication configured, the OOB pointer is passed directly to\nsg_init_one() and read by crypto_kpp_compute_shared_secret(), reaching\nup to 526 bytes past the buffer. This is exploitable pre-authentication.\n\nAdd bounds validation ensuring sizeof(*data) + 2*hl + dhvlen \u003c= tl before\nany access to the variable-length fields.\n\nDiscovered by Atuin - Automated Vulnerability Discovery Engine."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote peer can send the malformed Authentication Send command over NVMe/TCP, which dispatches it through nvmet_req_init() and nvmet_parse_fabrics_admin_cmd() to nvmet_execute_auth_send() and nvmet_auth_reply().\nAC:L - The attacker drives the required Connect, Negotiate, Receive, and Reply sequence and controls the transfer length, hash length, DH length, and transaction ID. No race or condition outside the attacker\u0027s control is required.\nPR:N - The allowed Host NQN is an attacker-supplied protocol identifier rather than a credential, and the actual DH-HMAC-CHAP secret is not verified until after the vulnerable read. The path is therefore exploitable pre-authentication.\nUI:N - No victim action is required after the target service and authentication configuration are active; the remote initiator independently completes the protocol sequence.\nS:U - The vulnerable NVMe target code and the affected kernel memory and availability belong to the same host security authority, with no demonstrated VM, IOMMU, or sandbox boundary crossing.\nC:H - The attacker controls a substantial kernel heap over-read through memcmp and the crypto scatterlist/MPI path, with the input pointer reaching hundreds of bytes beyond the allocation and an attacker-selected read length. Adjacent kernel secrets and pointers are therefore at risk.\nI:N - All identified unsafe accesses are reads into correctly sized cryptographic output buffers. No out-of-bounds write, arbitrary modification, or defensible authentication bypass was found.\nA:H - The crypto/MPI over-read can traverse heap-object and page boundaries and fault in kernel context, causing an oops or panic that takes down the storage target or host. An unauthenticated peer can reconnect and trigger it repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:43.881Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/04fb6ff8b87a0ffff3860ff52bdb2fd04b31ece5"
},
{
"url": "https://git.kernel.org/stable/c/80cd28b56ab62d3e7ed0a7bf05282e6d3ee5b2a0"
},
{
"url": "https://git.kernel.org/stable/c/999f6205ede984a786f35f727b01f971b98e215d"
},
{
"url": "https://git.kernel.org/stable/c/6d7649c1231dac14d906985d2936967e23041c26"
},
{
"url": "https://git.kernel.org/stable/c/caa71b3a43ea5c13fe7141cb019ebcb03b8ac857"
},
{
"url": "https://git.kernel.org/stable/c/3a413ece2504c70aa34a20be4dafec04e8c741f9"
}
],
"title": "nvmet-auth: validate reply message payload bounds against transfer length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64319",
"datePublished": "2026-07-25T08:49:48.291Z",
"dateReserved": "2026-07-19T15:36:31.780Z",
"dateUpdated": "2026-10-30T12:27:43.881Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98222 (GCVE-0-2026-98222)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KEYS: encrypted: fix integer overflow of datablob_len
encrypted_key_alloc() stores datablob_len in a u16. It is computed from
multiple string and payload lengths. If the result exceeds U16_MAX, the
assignment truncates the allocation size. KASAN reports a 32760-byte
slab-out-of-bounds write when __ekey_init() copies the master key
description into the undersized buffer.
The total payload length stored in key->datalen is also a u16. Use
check_add_overflow() to reject values that do not fit either destination,
and use kzalloc_flex() for the flexible-array allocation.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/keys/encrypted-keys/encrypted.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1e720f63dbafc093a8f5d519f05b67724993edd4",
"status": "affected",
"version": "7e70cb4978507cf31d76b90e4cfb4c28cad87f0c",
"versionType": "git"
},
{
"lessThan": "a1a98eca102b1cbbc37ff9eaa197ae4e6a3ea4b0",
"status": "affected",
"version": "7e70cb4978507cf31d76b90e4cfb4c28cad87f0c",
"versionType": "git"
},
{
"lessThan": "cca38f2102a4cd35eda8d48950df4817b4b24757",
"status": "affected",
"version": "7e70cb4978507cf31d76b90e4cfb4c28cad87f0c",
"versionType": "git"
},
{
"lessThan": "8697c431e297eb0d0ab13dda6bc172b48a34f05c",
"status": "affected",
"version": "7e70cb4978507cf31d76b90e4cfb4c28cad87f0c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/keys/encrypted-keys/encrypted.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"lessThan": "2.6.38",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: encrypted: fix integer overflow of datablob_len\n\nencrypted_key_alloc() stores datablob_len in a u16. It is computed from\nmultiple string and payload lengths. If the result exceeds U16_MAX, the\nassignment truncates the allocation size. KASAN reports a 32760-byte\nslab-out-of-bounds write when __ekey_init() copies the master key\ndescription into the undersized buffer.\n\nThe total payload length stored in key-\u003edatalen is also a u16. Use\ncheck_add_overflow() to reject values that do not fit either destination,\nand use kzalloc_flex() for the flexible-array allocation."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:54.199Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1e720f63dbafc093a8f5d519f05b67724993edd4"
},
{
"url": "https://git.kernel.org/stable/c/a1a98eca102b1cbbc37ff9eaa197ae4e6a3ea4b0"
},
{
"url": "https://git.kernel.org/stable/c/cca38f2102a4cd35eda8d48950df4817b4b24757"
},
{
"url": "https://git.kernel.org/stable/c/8697c431e297eb0d0ab13dda6bc172b48a34f05c"
}
],
"title": "KEYS: encrypted: fix integer overflow of datablob_len",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98222",
"datePublished": "2026-10-06T08:44:57.621Z",
"dateReserved": "2026-09-25T10:25:14.327Z",
"dateUpdated": "2026-10-19T09:15:54.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74283 (GCVE-0-2026-74283)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: require net admin for TIPCv2 netlink mutators
TIPCv2 registers mutating generic-netlink operations without admin
permission flags. Generic netlink only checks CAP_NET_ADMIN when an
operation sets GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM, so a local
unprivileged process can currently change TIPC state through commands
such as TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and
bearer enable/disable.
The legacy TIPC netlink API already checks netlink_net_capable(...,
CAP_NET_ADMIN) for administrative commands. Give the TIPCv2 mutators
the equivalent generic-netlink gate. Use GENL_UNS_ADMIN_PERM, which
maps to the same namespace-aware CAP_NET_ADMIN check that
netlink_net_capable() performs, so the behaviour matches the legacy
path and keeps working for CAP_NET_ADMIN holders in a non-initial user
namespace (containers).
A QEMU/KASAN repro run as uid/gid 65534 with zero effective
capabilities previously succeeded in changing the network id and node
identity, setting and flushing key material, and enabling/disabling a
UDP bearer. With this patch applied the same operations fail with
-EPERM.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0655f6a8635b1b66f2434d5556b1044c14b1ccaf Version: 0655f6a8635b1b66f2434d5556b1044c14b1ccaf Version: 0655f6a8635b1b66f2434d5556b1044c14b1ccaf Version: 0655f6a8635b1b66f2434d5556b1044c14b1ccaf Version: 0655f6a8635b1b66f2434d5556b1044c14b1ccaf Version: 0655f6a8635b1b66f2434d5556b1044c14b1ccaf Version: 0655f6a8635b1b66f2434d5556b1044c14b1ccaf Version: 0655f6a8635b1b66f2434d5556b1044c14b1ccaf |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74283",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:52:09.795417Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:30.055Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tipc/netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b06fb5f78a9af0929aaa47c92d0b7bca0617fb25",
"status": "affected",
"version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf",
"versionType": "git"
},
{
"lessThan": "52864c6c13dcc292481eabfeb3c31a86c3ec06f2",
"status": "affected",
"version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf",
"versionType": "git"
},
{
"lessThan": "e87dcc1a644d087de0bb6c94c6dd28c29b89597f",
"status": "affected",
"version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf",
"versionType": "git"
},
{
"lessThan": "9b937de4b3ded62a24da6e8d9d623cdb2748fa74",
"status": "affected",
"version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf",
"versionType": "git"
},
{
"lessThan": "c9668a4adb2264625daeeabc7466b783badd4614",
"status": "affected",
"version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf",
"versionType": "git"
},
{
"lessThan": "cebaefe1aceb650d5c99a4c0e1a4dde09e211818",
"status": "affected",
"version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf",
"versionType": "git"
},
{
"lessThan": "56f0a2e0a1d004e025cd031c3a801ab73959269f",
"status": "affected",
"version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf",
"versionType": "git"
},
{
"lessThan": "86b0c540e2ea397cde021eecd24145f7c16a3d4e",
"status": "affected",
"version": "0655f6a8635b1b66f2434d5556b1044c14b1ccaf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tipc/netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"lessThan": "3.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: require net admin for TIPCv2 netlink mutators\n\nTIPCv2 registers mutating generic-netlink operations without admin\npermission flags. Generic netlink only checks CAP_NET_ADMIN when an\noperation sets GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM, so a local\nunprivileged process can currently change TIPC state through commands\nsuch as TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and\nbearer enable/disable.\n\nThe legacy TIPC netlink API already checks netlink_net_capable(...,\nCAP_NET_ADMIN) for administrative commands. Give the TIPCv2 mutators\nthe equivalent generic-netlink gate. Use GENL_UNS_ADMIN_PERM, which\nmaps to the same namespace-aware CAP_NET_ADMIN check that\nnetlink_net_capable() performs, so the behaviour matches the legacy\npath and keeps working for CAP_NET_ADMIN holders in a non-initial user\nnamespace (containers).\n\nA QEMU/KASAN repro run as uid/gid 65534 with zero effective\ncapabilities previously succeeded in changing the network id and node\nidentity, setting and flushing key material, and enabling/disabling a\nUDP bearer. With this patch applied the same operations fail with\n-EPERM."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires sending TIPCv2 generic-netlink commands via a local NETLINK_GENERIC socket; the flaw is a missing authorization check on netlink mutators, not remote packet handling in the TIPC data plane.\nAC:L - Any unprivileged local process can open a generic-netlink socket and invoke the unprotected TIPCv2 mutators deterministically; no races, special memory layout, or victim state are required beyond TIPC being loaded.\nPR:L - The fix commit reproduces the issue as uid/gid 65534 (nobody) with zero effective capabilities; no CAP_NET_ADMIN or root in the initial namespace is needed, only standard local user access.\nUI:N - No victim interaction is required; the attacker directly issues netlink configuration commands to alter TIPC cluster state.\nS:U - Impact is unauthorized kernel/TIPC administration within the caller\u2019s network namespace (and global media tuning), not crossing a VM, container-to-host, or other distinct security-authority boundary.\nC:H - Unprivileged callers can set or flush TIPC AEAD encryption keys and reconfigure node/network identity, enabling decryption or exposure of protected inter-node cluster traffic that should require administrator control.\nI:H - Attackers can arbitrarily modify TIPC network ID, node identity, bearer/link/media parameters, monitoring settings, and cluster peer state, subverting intended cluster topology and cryptographic configuration.\nA:H - Unprivileged bearer disable/enable, peer removal, and key flush operations can repeatedly disrupt or partition TIPC cluster connectivity and encrypted communication, causing sustained denial of cluster service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:45:24.502Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b06fb5f78a9af0929aaa47c92d0b7bca0617fb25"
},
{
"url": "https://git.kernel.org/stable/c/52864c6c13dcc292481eabfeb3c31a86c3ec06f2"
},
{
"url": "https://git.kernel.org/stable/c/e87dcc1a644d087de0bb6c94c6dd28c29b89597f"
},
{
"url": "https://git.kernel.org/stable/c/9b937de4b3ded62a24da6e8d9d623cdb2748fa74"
},
{
"url": "https://git.kernel.org/stable/c/c9668a4adb2264625daeeabc7466b783badd4614"
},
{
"url": "https://git.kernel.org/stable/c/cebaefe1aceb650d5c99a4c0e1a4dde09e211818"
},
{
"url": "https://git.kernel.org/stable/c/56f0a2e0a1d004e025cd031c3a801ab73959269f"
},
{
"url": "https://git.kernel.org/stable/c/86b0c540e2ea397cde021eecd24145f7c16a3d4e"
}
],
"title": "tipc: require net admin for TIPCv2 netlink mutators",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74283",
"datePublished": "2026-08-15T05:57:52.667Z",
"dateReserved": "2026-08-15T05:44:03.881Z",
"dateUpdated": "2026-10-16T18:55:30.055Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72080 (GCVE-0-2026-72080)
Vulnerability from cvelistv5
Published
2026-08-15 05:52
Modified
2026-10-19 21:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs/resctrl: Fix use-after-free during unmount
During unmount or failure teardown all mon_data structures that contain
monitoring event file private data are freed after which kernfs nodes are
removed. However, the RDT_DELETED flag is never set for the statically
allocated default resource group.
A concurrent reader of an event file associated with the default resource
group may, after dropping kernfs active protection, block on rdtgroup_mutex
while unmount proceeds to free the file private data and destroy the kernfs
node without waiting for the reader.
When the mutex is released, the reader wakes up, observes that RDT_DELETED
is not set for the default group, and dereferences the already-freed
file private data.
The scenario can be depicted as follows:
CPU0 CPU1
/*
* Default resource group's
* monitoring data accessible via
* kernfs file with kernfs_node::priv
* pointing to a struct mon_data.
* User opens the file for reading.
*/
rdtgroup_mondata_show() /* arch encounters fatal error */
rdtgroup_kn_lock_live() resctrl_exit()
atomic_inc(&rdtgroup_default.waitcount) cpus_read_lock()
kernfs_break_active_protection(kn) mutex_lock(&rdtgroup_mutex)
cpus_read_lock() resctrl_fs_teardown()
mutex_lock(&rdtgroup_mutex) rmdir_all_sub()
mon_put_kn_priv()
/* Delete all mon_data structures */
rdtgroup_destroy_root()
kernfs_destroy_root()
rdtgroup_default.kn = NULL
mutex_unlock(&rdtgroup_mutex)
/*
* rdtgroup_default.flags is empty so
* rdtgroup_kn_lock_live() returns
* &rdtgroup_default
*/
md = of->kn->priv;
/* md points to freed mon_data */
Set RDT_DELETED for the default group unconditionally since the flag does
not lead to the freeing of this statically allocated group.
Do not allow a new resctrl mount if there are any waiters on default group
of previous mount. A new mount will re-initialize the default group that
would appear to waiters from previous mount as though the default group is
accessible causing them to access the mon_data structures from the previous
mount that have been removed.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72080",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:51:36.934072Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:19:26.766Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/resctrl/rdtgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7b7bb07efe41bb646a93c4624aa2bb35df190342",
"status": "affected",
"version": "2a65660385444e9d9deffe995c71ee20443ef76e",
"versionType": "git"
},
{
"lessThan": "7d330a1d663381579b9d5dafa642b1b3158a0ce2",
"status": "affected",
"version": "2a65660385444e9d9deffe995c71ee20443ef76e",
"versionType": "git"
},
{
"lessThan": "52fce648607e0d6a76eeb443d78708c49df1c554",
"status": "affected",
"version": "2a65660385444e9d9deffe995c71ee20443ef76e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/resctrl/rdtgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/resctrl: Fix use-after-free during unmount\n\nDuring unmount or failure teardown all mon_data structures that contain\nmonitoring event file private data are freed after which kernfs nodes are\nremoved. However, the RDT_DELETED flag is never set for the statically\nallocated default resource group.\n\nA concurrent reader of an event file associated with the default resource\ngroup may, after dropping kernfs active protection, block on rdtgroup_mutex\nwhile unmount proceeds to free the file private data and destroy the kernfs\nnode without waiting for the reader.\n\nWhen the mutex is released, the reader wakes up, observes that RDT_DELETED\nis not set for the default group, and dereferences the already-freed\nfile private data.\n\nThe scenario can be depicted as follows:\n CPU0 CPU1\n /*\n * Default resource group\u0027s\n * monitoring data accessible via\n * kernfs file with kernfs_node::priv\n * pointing to a struct mon_data.\n * User opens the file for reading.\n */\n rdtgroup_mondata_show() /* arch encounters fatal error */\n rdtgroup_kn_lock_live() resctrl_exit()\n atomic_inc(\u0026rdtgroup_default.waitcount) cpus_read_lock()\n kernfs_break_active_protection(kn) mutex_lock(\u0026rdtgroup_mutex)\n cpus_read_lock() resctrl_fs_teardown()\n mutex_lock(\u0026rdtgroup_mutex) rmdir_all_sub()\n mon_put_kn_priv()\n /* Delete all mon_data structures */\n rdtgroup_destroy_root()\n kernfs_destroy_root()\n rdtgroup_default.kn = NULL\n mutex_unlock(\u0026rdtgroup_mutex)\n /*\n * rdtgroup_default.flags is empty so\n * rdtgroup_kn_lock_live() returns\n * \u0026rdtgroup_default\n */\n md = of-\u003ekn-\u003epriv;\n\n /* md points to freed mon_data */\n\nSet RDT_DELETED for the default group unconditionally since the flag does\nnot lead to the freeing of this statically allocated group.\n\nDo not allow a new resctrl mount if there are any waiters on default group\nof previous mount. A new mount will re-initialize the default group that\nwould appear to waiters from previous mount as though the default group is\naccessible causing them to access the mon_data structures from the previous\nmount that have been removed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached by a local process reading resctrl monitoring event files under /sys/fs/resctrl via open/read on kernfs; there is no network, Bluetooth, or physical-device entry path to rdtgroup_mondata_show().\nAC:L - This is a race between a reader in rdtgroup_kn_lock_live() and teardown in resctrl_fs_teardown()/resctrl_exit(); an attacker can drive both sides with concurrent threads (read mondata while unmounting or during MPAM-initiated teardown) and retry until the window is hit.\nPR:L - Default-group mondata files are world-readable (0444) once resctrl is mounted; triggering teardown via umount is reachable with CAP_SYS_ADMIN from an unprivileged user namespace, and on ARM MPAM systems resctrl_exit() can run while any local user is reading.\nUI:N - No victim interaction is required; the attacker opens and reads monitoring files and initiates or times concurrent resctrl unmount/teardown themselves to win the race.\nS:U - Exploitation corrupts kernel heap memory and enables local privilege escalation within the same kernel security authority; it does not cross a VM, container, or IOMMU boundary by itself.\nC:H - Use-after-free of kmalloc\u0027d struct mon_data lets the attacker influence freed object contents; subsequent reads of md-\u003erid, md-\u003edomid, and md-\u003eevt enable arbitrary kernel memory disclosure through mon_event_read().\nI:H - The UAF provides a controllable heap primitive; forged mon_data/evt pointers passed into mon_event_read() and resctrl_arch_mon_ctx_alloc() can be leveraged for arbitrary kernel writes and local code execution.\nA:H - Dereferencing freed mon_data during rdtgroup_mondata_show() can immediately kernel oops/panic the system, and repeated triggering of the race provides a reliable denial-of-service even before full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:40:04.208Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7b7bb07efe41bb646a93c4624aa2bb35df190342"
},
{
"url": "https://git.kernel.org/stable/c/7d330a1d663381579b9d5dafa642b1b3158a0ce2"
},
{
"url": "https://git.kernel.org/stable/c/52fce648607e0d6a76eeb443d78708c49df1c554"
}
],
"title": "fs/resctrl: Fix use-after-free during unmount",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72080",
"datePublished": "2026-08-15T05:52:29.827Z",
"dateReserved": "2026-08-09T03:40:39.904Z",
"dateUpdated": "2026-10-19T21:19:26.766Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52972 (GCVE-0-2026-52972)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-11-06 16:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: af_alg - Cap AEAD AD length to 0x80000000
In order to prevent arithmetic overflows when checking the TX
buffer size, cap the associated data length to 0x80000000.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s `af_alg` cryptography module. This vulnerability involves an arithmetic overflow when processing associated data lengths during the transmit buffer size check. A remote attacker could exploit this flaw by providing a specially crafted associated data length, potentially leading to a denial of service (DoS) due to system instability."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T02:46:50.271Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52972"
},
{
"name": "RHBZ#2492364",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492364"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52972.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-52972",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:15:30.567415Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:23:52.041Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/af_alg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f8a5203596797f394ff3f9aa4005597a92249802",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "a9f68d9ed38dd6e5a6c6d75b03d25c1c133e321d",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "a4fe4eb580bbc7439f649a496d4cf38415a4021c",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "e4c4a5074532eaaa14951994a3aad0d479aa7431",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "265ac26d1c5e17b34d497cbda1f754a1ec8552bc",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "a1c5672faf8e93e38c2deac3979cc767ca5cf918",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "97948906dc8e0ea84775e03e35b60a2063c70193",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "0b3a57d218618cb1cc78ddc9ba02c07de84b46f4",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "e4c06479d7059888adf2f22bc1ebcf053bf691a2",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/af_alg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Cap AEAD AD length to 0x80000000\n\nIn order to prevent arithmetic overflows when checking the TX\nbuffer size, cap the associated data length to 0x80000000."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:24.931Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f8a5203596797f394ff3f9aa4005597a92249802"
},
{
"url": "https://git.kernel.org/stable/c/a9f68d9ed38dd6e5a6c6d75b03d25c1c133e321d"
},
{
"url": "https://git.kernel.org/stable/c/a4fe4eb580bbc7439f649a496d4cf38415a4021c"
},
{
"url": "https://git.kernel.org/stable/c/e4c4a5074532eaaa14951994a3aad0d479aa7431"
},
{
"url": "https://git.kernel.org/stable/c/265ac26d1c5e17b34d497cbda1f754a1ec8552bc"
},
{
"url": "https://git.kernel.org/stable/c/a1c5672faf8e93e38c2deac3979cc767ca5cf918"
},
{
"url": "https://git.kernel.org/stable/c/97948906dc8e0ea84775e03e35b60a2063c70193"
},
{
"url": "https://git.kernel.org/stable/c/0b3a57d218618cb1cc78ddc9ba02c07de84b46f4"
},
{
"url": "https://git.kernel.org/stable/c/e4c06479d7059888adf2f22bc1ebcf053bf691a2"
}
],
"title": "crypto: af_alg - Cap AEAD AD length to 0x80000000",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52972",
"datePublished": "2026-06-24T16:28:50.425Z",
"dateReserved": "2026-06-09T07:44:35.375Z",
"dateUpdated": "2026-11-06T16:23:52.041Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46259 (GCVE-0-2026-46259)
Vulnerability from cvelistv5
Published
2026-06-03 15:49
Modified
2026-10-19 19:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
procfs: fix missing RCU protection when reading real_parent in do_task_stat()
When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent
without proper RCU protection, which leads to:
cpu 0 cpu 1
----- -----
do_task_stat
var = task->real_parent
release_task
call_rcu(delayed_put_task_struct)
task_tgid_nr_ns(var)
rcu_read_lock <--- Too late to protect task->real_parent!
task_pid_ptr <--- UAF!
rcu_read_unlock
This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add
proper RCU protection for accessing task->real_parent.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 06fffb1267c9d986687b69d74a46ee332a50575e Version: 06fffb1267c9d986687b69d74a46ee332a50575e Version: 06fffb1267c9d986687b69d74a46ee332a50575e Version: 06fffb1267c9d986687b69d74a46ee332a50575e Version: 06fffb1267c9d986687b69d74a46ee332a50575e Version: 06fffb1267c9d986687b69d74a46ee332a50575e Version: 06fffb1267c9d986687b69d74a46ee332a50575e Version: 06fffb1267c9d986687b69d74a46ee332a50575e |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46259",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:21:25.410048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:36:56.158Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/proc/array.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fefa0fcd78be465b7ad4c497fa6ec90d64194c04",
"status": "affected",
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
"versionType": "git"
},
{
"lessThan": "c93a33f28f915d446eea6fb3f0e1def0b3af1982",
"status": "affected",
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
"versionType": "git"
},
{
"lessThan": "1c8dc5b5517546c68ffae40b948336122bb61306",
"status": "affected",
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
"versionType": "git"
},
{
"lessThan": "0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e",
"status": "affected",
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
"versionType": "git"
},
{
"lessThan": "73ec7c96601d61d52310c659145bb06d933a0fa6",
"status": "affected",
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
"versionType": "git"
},
{
"lessThan": "4f9ae386861e280b7631ca252f798d25575627ee",
"status": "affected",
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
"versionType": "git"
},
{
"lessThan": "dd8b13cb4ff1a4545a214ed897fdf2bc341155b6",
"status": "affected",
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
"versionType": "git"
},
{
"lessThan": "76149d53502cf17ef3ae454ff384551236fba867",
"status": "affected",
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/proc/array.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nprocfs: fix missing RCU protection when reading real_parent in do_task_stat()\n\nWhen reading /proc/[pid]/stat, do_task_stat() accesses task-\u003ereal_parent\nwithout proper RCU protection, which leads to:\n\n cpu 0 cpu 1\n ----- -----\n do_task_stat\n var = task-\u003ereal_parent\n release_task\n call_rcu(delayed_put_task_struct)\n task_tgid_nr_ns(var)\n rcu_read_lock \u003c--- Too late to protect task-\u003ereal_parent!\n task_pid_ptr \u003c--- UAF!\n rcu_read_unlock\n\nThis patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add\nproper RCU protection for accessing task-\u003ereal_parent."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local `open()`/`read()` on procfs (`/proc/[pid]/stat` or thread `stat`); there is no network, adjacent-radio, or physical-device path to `do_task_stat()`.\nAC:L - An attacker can reliably race by running concurrent `read()` loops on `/proc/child/stat` while another thread exits and reaps the parent via `wait4()`, controlling both sides of the `release_task()`/`call_rcu()` window.\nPR:L - Triggering the bug needs only an unprivileged local account that can read procfs (default `hidepid=off` allows reading other users\u2019 `stat`); no real root or init-namespace-only capability is required.\nUI:N - Exploitation is fully attacker-driven through syscalls and process lifecycle control; no victim user action (clicks, mounts, etc.) is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain, not a cross-boundary escape such as VM guest-to-host.\nC:H - The UAF dereferences freed `task_struct` memory via `task_pid_ptr()`/`__task_pid_nr_ns()`, enabling disclosure of stale slab contents and kernel pointers that can be groomed into an arbitrary-read primitive.\nI:H - Use-after-free on a `task_struct` slab object can be leveraged with heap grooming for control of freed memory and potential arbitrary write or code execution, not merely a bounded or cosmetic change.\nA:H - Concurrent UAF access to a freed parent `task_struct` can cause kernel oops/panic (KASAN reports slab-use-after-free class failures) even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:48.120Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fefa0fcd78be465b7ad4c497fa6ec90d64194c04"
},
{
"url": "https://git.kernel.org/stable/c/c93a33f28f915d446eea6fb3f0e1def0b3af1982"
},
{
"url": "https://git.kernel.org/stable/c/1c8dc5b5517546c68ffae40b948336122bb61306"
},
{
"url": "https://git.kernel.org/stable/c/0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e"
},
{
"url": "https://git.kernel.org/stable/c/73ec7c96601d61d52310c659145bb06d933a0fa6"
},
{
"url": "https://git.kernel.org/stable/c/4f9ae386861e280b7631ca252f798d25575627ee"
},
{
"url": "https://git.kernel.org/stable/c/dd8b13cb4ff1a4545a214ed897fdf2bc341155b6"
},
{
"url": "https://git.kernel.org/stable/c/76149d53502cf17ef3ae454ff384551236fba867"
}
],
"title": "procfs: fix missing RCU protection when reading real_parent in do_task_stat()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46259",
"datePublished": "2026-06-03T15:49:56.428Z",
"dateReserved": "2026-05-13T15:03:33.108Z",
"dateUpdated": "2026-10-19T19:36:56.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52929 (GCVE-0-2026-52929)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-10-19 19:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: stream: fully roll back denied add-stream state
When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and
then lowers outcnt. That leaves removed stream metadata behind, so a
later re-add can reuse a stale ext and hit a null-pointer dereference in
the scheduler get path.
Fix the rollback by tearing down the removed stream state the same way
other stream resizes do. Unschedule the current scheduler state, drop
the removed stream ext state with sctp_stream_outq_migrate(), and then
reschedule the remaining streams.
This keeps scheduler-private RR/FC/PRIO lists consistent while fully
rolling back denied outgoing stream additions.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 637784ade221a3c8a7ecd0f583eddd95d6276b9a Version: 637784ade221a3c8a7ecd0f583eddd95d6276b9a Version: 637784ade221a3c8a7ecd0f583eddd95d6276b9a Version: 637784ade221a3c8a7ecd0f583eddd95d6276b9a Version: 637784ade221a3c8a7ecd0f583eddd95d6276b9a Version: 637784ade221a3c8a7ecd0f583eddd95d6276b9a Version: 637784ade221a3c8a7ecd0f583eddd95d6276b9a Version: 637784ade221a3c8a7ecd0f583eddd95d6276b9a |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:21:52.989Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-52929",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:22:54.348092Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:47:07.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/stream.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0cd2dc6dce8ca47212cd306ccd52eb315ef3cf85",
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"versionType": "git"
},
{
"lessThan": "a6724b7b812ac8793514a1d5938db5d9d29ae725",
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"versionType": "git"
},
{
"lessThan": "9662eb0401518f0b4681f10e7fbf688f504f24cf",
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"versionType": "git"
},
{
"lessThan": "7dd9a42b044aad2dbe037db1c1e2943582485b44",
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"versionType": "git"
},
{
"lessThan": "39dc2b0eb5371a669ebc9ec6072b9184eac95418",
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"versionType": "git"
},
{
"lessThan": "d5ea0b3e261fcb2cfff142675516165244cab1da",
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"versionType": "git"
},
{
"lessThan": "1c6773b8c081509dcd5cd2954f2b02c50c00f151",
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"versionType": "git"
},
{
"lessThan": "a5f8a90ac9f77c678a9781c0a464b635e0d63e49",
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/stream.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: stream: fully roll back denied add-stream state\n\nWhen ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and\nthen lowers outcnt. That leaves removed stream metadata behind, so a\nlater re-add can reuse a stale ext and hit a null-pointer dereference in\nthe scheduler get path.\n\nFix the rollback by tearing down the removed stream state the same way\nother stream resizes do. Unschedule the current scheduler state, drop\nthe removed stream ext state with sctp_stream_outq_migrate(), and then\nreschedule the remaining streams.\n\nThis keeps scheduler-private RR/FC/PRIO lists consistent while fully\nrolling back denied outgoing stream additions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is reached while processing an SCTP RE-CONFIG response chunk received from a remote SCTP peer on an established association. A malicious peer can send a denied ADD_OUT_STREAMS response over the network once stream reconfiguration is negotiated.\nAC:L - The packet/state sequence is protocol-controlled and reproducible: negotiate SCTP RE-CONFIG, trigger an ADD_OUT_STREAMS request, deny it, then cause later reuse of the stale stream state. Although RE-CONFIG must be enabled by the application, there is no race or condition outside the attacker\u0027s reasonable influence in a deployment using this feature.\nPR:N - A remote SCTP peer does not need local kernel privileges or authenticated OS privileges to send the denial response. The path is gated by SCTP association state, verification tag, and matching outstanding request sequence, not by credentials.\nUI:N - No human user interaction is required once the SCTP service/association is operating with stream reconfiguration. The triggering input is network protocol traffic from the peer.\nS:U - The vulnerability affects kernel SCTP state within the same host security authority. It does not cross a VM, IOMMU, or other separate authorization boundary.\nC:N - The investigated failure mode is stale SCTP stream scheduler metadata leading to a NULL pointer dereference in scheduler value retrieval. I did not find evidence of an attacker-controlled memory read or information disclosure primitive.\nI:N - The bug leaves scheduler-private stream state inconsistent but the demonstrated impact is a NULL dereference/crash, not controlled data modification or code execution. No arbitrary write primitive was evident from the rollback path.\nA:H - The stale stream extension state can lead to a kernel NULL pointer dereference/oops in the SCTP scheduler path. A remotely reachable kernel crash is a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:47.863Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0cd2dc6dce8ca47212cd306ccd52eb315ef3cf85"
},
{
"url": "https://git.kernel.org/stable/c/a6724b7b812ac8793514a1d5938db5d9d29ae725"
},
{
"url": "https://git.kernel.org/stable/c/9662eb0401518f0b4681f10e7fbf688f504f24cf"
},
{
"url": "https://git.kernel.org/stable/c/7dd9a42b044aad2dbe037db1c1e2943582485b44"
},
{
"url": "https://git.kernel.org/stable/c/39dc2b0eb5371a669ebc9ec6072b9184eac95418"
},
{
"url": "https://git.kernel.org/stable/c/d5ea0b3e261fcb2cfff142675516165244cab1da"
},
{
"url": "https://git.kernel.org/stable/c/1c6773b8c081509dcd5cd2954f2b02c50c00f151"
},
{
"url": "https://git.kernel.org/stable/c/a5f8a90ac9f77c678a9781c0a464b635e0d63e49"
}
],
"title": "sctp: stream: fully roll back denied add-stream state",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52929",
"datePublished": "2026-06-24T07:14:22.020Z",
"dateReserved": "2026-06-09T07:44:35.368Z",
"dateUpdated": "2026-10-19T19:47:07.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89481 (GCVE-0-2026-89481)
Vulnerability from cvelistv5
Published
2026-09-11 19:43
Modified
2026-10-30 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: fix host memory disclosure on R2T for a read command
nvme_tcp_handle_r2t() does not check the direction of the request the
R2T refers to. A malicious controller can send an R2T for a READ and
the host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the
H2CData header and nvme_tcp_try_send_data() sends the request's data
buffer. That buffer is the READ destination, so its contents go to the
controller.
The command then completes normally and nothing is logged.
Against a test controller that answers every READ with an R2T, a 4096
byte buffered read returned all 4096 bytes, split over two R2Ts. The
pages contained stale kernel data, including an array of struct page
pointers.
Reject an R2T for a request that is not a write.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3f2304f8c6d6ed97849057bd16fee99e434ca796 Version: 3f2304f8c6d6ed97849057bd16fee99e434ca796 Version: 3f2304f8c6d6ed97849057bd16fee99e434ca796 Version: 3f2304f8c6d6ed97849057bd16fee99e434ca796 Version: 3f2304f8c6d6ed97849057bd16fee99e434ca796 Version: 3f2304f8c6d6ed97849057bd16fee99e434ca796 Version: 3f2304f8c6d6ed97849057bd16fee99e434ca796 Version: 3f2304f8c6d6ed97849057bd16fee99e434ca796 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89481",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:22:35.614121Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:39.687Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "effe898669c5f69ed519d6339be01ee9cd91d1a4",
"status": "affected",
"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796",
"versionType": "git"
},
{
"lessThan": "377aa04d7b3e73ffef6364818def188da8d6f025",
"status": "affected",
"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796",
"versionType": "git"
},
{
"lessThan": "49a4dcf57608ebf6432dbcb203ed25e7ed581445",
"status": "affected",
"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796",
"versionType": "git"
},
{
"lessThan": "bc4013c7cce58d46f792c8c87bc8c8318a70190e",
"status": "affected",
"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796",
"versionType": "git"
},
{
"lessThan": "a4c3c7310156493797c920b10d8648c07aa05403",
"status": "affected",
"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796",
"versionType": "git"
},
{
"lessThan": "3b3d27670c0c890ba7cf1bc3614cab61bde6d25c",
"status": "affected",
"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796",
"versionType": "git"
},
{
"lessThan": "3a0b05145053a5fad1a2ddb4e4d87b07385e63e5",
"status": "affected",
"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796",
"versionType": "git"
},
{
"lessThan": "6efbc52237facda35d2d874fe1765bb4839275d8",
"status": "affected",
"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix host memory disclosure on R2T for a read command\n\nnvme_tcp_handle_r2t() does not check the direction of the request the\nR2T refers to. A malicious controller can send an R2T for a READ and\nthe host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the\nH2CData header and nvme_tcp_try_send_data() sends the request\u0027s data\nbuffer. That buffer is the READ destination, so its contents go to the\ncontroller.\n\nThe command then completes normally and nothing is logged.\n\nAgainst a test controller that answers every READ with an R2T, a 4096\nbyte buffered read returned all 4096 bytes, split over two R2Ts. The\npages contained stale kernel data, including an array of struct page\npointers.\n\nReject an R2T for a request that is not a write."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in the NVMe-over-TCP host PDU receive path (nvme_tcp_recv_skb \u2192 nvme_tcp_handle_r2t). A remote NVMe-oF target or on-path attacker sends an R2T PDU over TCP (port 4420) and the host splices the READ destination buffer back over that socket.\nAC:L - A malicious controller that replies to an in-flight READ with a well-formed R2T always triggers the leak; the reporter reproduced a full 4096-byte disclosure with a test target. No race, special memory layout, or rare config beyond CONFIG_NVME_TCP is required.\nPR:N - NVMe/TCP requires no authentication by default (TLS and DH-HMAC-CHAP are optional and off in stock configs), so the remote peer needs no privileges or credentials on the victim host; it simply answers I/O the host is already sending.\nUI:N - No victim action is required at exploit time; once the host is connected (including via nvmf-autoconnect at boot), ordinary filesystem or block I/O issues READ commands and the malicious target triggers the leak by replying with R2T PDUs.\nS:U - The disclosure is of the host kernel\u0027s own I/O buffers and page-cache pages to the connected target. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - nvme_tcp_try_send_data() splices the READ destination pages to the attacker. Those pages hold stale kernel memory (reproduced: 4096 bytes including struct page pointers). Every subsequent READ can leak another MDTS-sized buffer of recycled kernel pages.\nI:N - The host only transmits existing buffer contents; the bug does not write attacker-controlled data into kernel memory, corrupt kernel structures, or provide a write or control-flow hijack primitive.\nA:N - The malformed R2T path completes the command successfully with nothing logged; the reporter observed a silent disclosure with no oops, panic, hang, or other availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:31:53.844Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/effe898669c5f69ed519d6339be01ee9cd91d1a4"
},
{
"url": "https://git.kernel.org/stable/c/377aa04d7b3e73ffef6364818def188da8d6f025"
},
{
"url": "https://git.kernel.org/stable/c/49a4dcf57608ebf6432dbcb203ed25e7ed581445"
},
{
"url": "https://git.kernel.org/stable/c/bc4013c7cce58d46f792c8c87bc8c8318a70190e"
},
{
"url": "https://git.kernel.org/stable/c/a4c3c7310156493797c920b10d8648c07aa05403"
},
{
"url": "https://git.kernel.org/stable/c/3b3d27670c0c890ba7cf1bc3614cab61bde6d25c"
},
{
"url": "https://git.kernel.org/stable/c/3a0b05145053a5fad1a2ddb4e4d87b07385e63e5"
},
{
"url": "https://git.kernel.org/stable/c/6efbc52237facda35d2d874fe1765bb4839275d8"
}
],
"title": "nvme-tcp: fix host memory disclosure on R2T for a read command",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89481",
"datePublished": "2026-09-11T19:43:36.589Z",
"dateReserved": "2026-09-11T19:38:34.711Z",
"dateUpdated": "2026-10-30T12:31:53.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74669 (GCVE-0-2026-74669)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-10-16 19:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the
quoted original request before passing it to icmp_send(). However,
IPCB(skb)->opt still describes the outer IPv4 header.
A timestamp option in the outer header can therefore leave an offset
that points into the quoted transport header after the rebase.
__ip_options_echo() treats a byte at that stale location as the option
length and copies it into the fixed-size option storage on the
__icmp_send() stack, causing a stack out-of-bounds write.
Clear the stale option metadata after resetting the network header.
Keep the remaining control block fields, including the ingress
interface used by the ICMP response path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e Version: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e Version: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e Version: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e Version: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e Version: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e Version: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e Version: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74669",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:14:21.602938Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:16:08.572Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "79ffa99202c944467e28b13b513bf2998732edff",
"status": "affected",
"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
"versionType": "git"
},
{
"lessThan": "c9413b50204738fbc429bb86bf01353c393a6c28",
"status": "affected",
"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
"versionType": "git"
},
{
"lessThan": "37c61b3745129cbd682c557b51345828120972e5",
"status": "affected",
"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
"versionType": "git"
},
{
"lessThan": "ed246dd85ebf27c1f6b7897834d40786c0ca3006",
"status": "affected",
"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
"versionType": "git"
},
{
"lessThan": "6f46fc460e9316062bdcdf89199eb5d7a33da33b",
"status": "affected",
"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
"versionType": "git"
},
{
"lessThan": "75eec935444db4af2123e0491936f6e273d7ea00",
"status": "affected",
"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
"versionType": "git"
},
{
"lessThan": "384b4dae14277d369221d187e9b3af56c79d2e50",
"status": "affected",
"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
"versionType": "git"
},
{
"lessThan": "e0ba936287dfe9783426aac27e5fd76fe35b38c9",
"status": "affected",
"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear IPv4 options after rebasing tunnel ICMP errors\n\nip_vs_in_icmp() rebases an skb from the outer ICMP packet to the\nquoted original request before passing it to icmp_send(). However,\nIPCB(skb)-\u003eopt still describes the outer IPv4 header.\n\nA timestamp option in the outer header can therefore leave an offset\nthat points into the quoted transport header after the rebase.\n__ip_options_echo() treats a byte at that stale location as the option\nlength and copies it into the fixed-size option storage on the\n__icmp_send() stack, causing a stack out-of-bounds write.\n\nClear the stale option metadata after resetting the network header.\nKeep the remaining control block fields, including the ingress\ninterface used by the ICMP response path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is hit when a remote peer sends a crafted ICMP error to an IPVS load balancer; processing occurs in the IPv4 LOCAL_IN/FORWARD netfilter path on received network packets before icmp_send().\nAC:L - An attacker can reliably trigger the path by opening IPVS tunnel traffic, then sending an ICMP error whose outer IPv4 header includes a timestamp option and whose quoted payload aligns bytes at the stale option offset to a large length.\nPR:N - Exploitation requires only the ability to send IPv4/ICMP to the target; the remote attacker needs no local account, capability, or authentication on the victim host.\nUI:N - No victim user action is required beyond normal exposure of an IPVS tunnel load balancer to the network; exploitation is driven entirely by attacker-sent packets.\nS:U - Impact is confined to kernel memory/stack corruption and privilege boundaries within the host kernel; it does not cross into another security authority such as a VM guest or separate sandbox domain.\nC:H - The stale IPCB option metadata drives __ip_options_echo() to memcpy() from attacker-influenced skb bytes into a 40-byte stack buffer, enabling out-of-bounds kernel memory access that can disclose stack/kernel data.\nI:H - The stack out-of-bounds write in __icmp_send() is attacker-controlled in length and content via crafted quoted headers, providing a standard memory-corruption primitive that can corrupt return addresses and enable arbitrary kernel code execution.\nA:H - Corrupting the __icmp_send() stack frame can immediately panic or oops the kernel during ICMP processing, causing complete loss of availability on the load balancer."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:24.114Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/79ffa99202c944467e28b13b513bf2998732edff"
},
{
"url": "https://git.kernel.org/stable/c/c9413b50204738fbc429bb86bf01353c393a6c28"
},
{
"url": "https://git.kernel.org/stable/c/37c61b3745129cbd682c557b51345828120972e5"
},
{
"url": "https://git.kernel.org/stable/c/ed246dd85ebf27c1f6b7897834d40786c0ca3006"
},
{
"url": "https://git.kernel.org/stable/c/6f46fc460e9316062bdcdf89199eb5d7a33da33b"
},
{
"url": "https://git.kernel.org/stable/c/75eec935444db4af2123e0491936f6e273d7ea00"
},
{
"url": "https://git.kernel.org/stable/c/384b4dae14277d369221d187e9b3af56c79d2e50"
},
{
"url": "https://git.kernel.org/stable/c/e0ba936287dfe9783426aac27e5fd76fe35b38c9"
}
],
"title": "ipvs: clear IPv4 options after rebasing tunnel ICMP errors",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74669",
"datePublished": "2026-08-22T15:32:40.221Z",
"dateReserved": "2026-08-15T05:44:03.924Z",
"dateUpdated": "2026-10-16T19:16:08.572Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53073 (GCVE-0-2026-53073)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-11-06 16:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
When hci_register_dev() fails in hci_uart_register_dev()
HCI_UART_PROTO_INIT is not cleared before calling hu->proto->close(hu)
and setting hu->hdev to NULL. This means incoming UART data will reach
the protocol-specific recv handler in hci_uart_tty_receive() after
resources are freed.
Clear HCI_UART_PROTO_INIT with a write lock before calling
hu->proto->close() and setting hu->hdev to NULL. The write lock ensures
all active readers have completed and no new reader can enter the
protocol recv path before resources are freed.
This allows the protocol-specific recv functions to remove the
"HCI_UART_REGISTERED" guard without risking a null pointer dereference
if hci_register_dev() fails.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a40f94f7caa8d3421b64f63ac31bc0f24c890f39 Version: 9e5a0f5777162e503400c70c6ed25fbbe2d38799 Version: 80f14e9de6a43a0bd8194cad1003a3e6dcbc3984 Version: 02e1bcdfdf769974e7e9fa285e295cd9852e2a38 Version: 281782d2c6730241e300d630bb9f200d831ede71 Version: 5df5dafc171b90d0b8d51547a82657cd5a1986c7 Version: 5df5dafc171b90d0b8d51547a82657cd5a1986c7 Version: 5df5dafc171b90d0b8d51547a82657cd5a1986c7 Version: 1dcf08fcff5ca529de6dc0395091f28854f4e54a Version: 8e5aff600539e5faea294d9612cca50220e602b8 Version: db7509fa110dd9b11134b75894677f30353b2c51 Version: 5.10.237 ≤ Version: 5.15.181 ≤ Version: 6.1.135 ≤ Version: 6.6.88 ≤ Version: 6.12.24 ≤ Version: 5.4.293 ≤ Version: 6.13.12 ≤ Version: 6.14.3 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53073",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:17:48.192876Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:23:58.102Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/hci_ldisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07",
"status": "affected",
"version": "a40f94f7caa8d3421b64f63ac31bc0f24c890f39",
"versionType": "git"
},
{
"lessThan": "ed4033fb85ccaaf6c3983be3c7b037e48253d232",
"status": "affected",
"version": "9e5a0f5777162e503400c70c6ed25fbbe2d38799",
"versionType": "git"
},
{
"lessThan": "356dee1bcac4d0d9152390561fa63331ebff211b",
"status": "affected",
"version": "80f14e9de6a43a0bd8194cad1003a3e6dcbc3984",
"versionType": "git"
},
{
"lessThan": "a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40",
"status": "affected",
"version": "02e1bcdfdf769974e7e9fa285e295cd9852e2a38",
"versionType": "git"
},
{
"lessThan": "f4b69c35813c432973d340d3600c01de106ed474",
"status": "affected",
"version": "281782d2c6730241e300d630bb9f200d831ede71",
"versionType": "git"
},
{
"lessThan": "3daa5818e473ed60eb69d8b5c71b651909d28c5a",
"status": "affected",
"version": "5df5dafc171b90d0b8d51547a82657cd5a1986c7",
"versionType": "git"
},
{
"lessThan": "194f029a4d7f739e44ebc1f473120187b4de5104",
"status": "affected",
"version": "5df5dafc171b90d0b8d51547a82657cd5a1986c7",
"versionType": "git"
},
{
"lessThan": "68d39ea5e0adc9ecaea1ce8abd842ec972eb8718",
"status": "affected",
"version": "5df5dafc171b90d0b8d51547a82657cd5a1986c7",
"versionType": "git"
},
{
"status": "affected",
"version": "1dcf08fcff5ca529de6dc0395091f28854f4e54a",
"versionType": "git"
},
{
"status": "affected",
"version": "8e5aff600539e5faea294d9612cca50220e602b8",
"versionType": "git"
},
{
"status": "affected",
"version": "db7509fa110dd9b11134b75894677f30353b2c51",
"versionType": "git"
},
{
"lessThan": "5.10.258",
"status": "affected",
"version": "5.10.237",
"versionType": "semver"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.181",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.135",
"versionType": "semver"
},
{
"lessThan": "6.6.141",
"status": "affected",
"version": "6.6.88",
"versionType": "semver"
},
{
"lessThan": "6.12.91",
"status": "affected",
"version": "6.12.24",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.293",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.12",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/hci_ldisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10.237",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.181",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.135",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.6.88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.12.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.293",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error\n\nWhen hci_register_dev() fails in hci_uart_register_dev()\nHCI_UART_PROTO_INIT is not cleared before calling hu-\u003eproto-\u003eclose(hu)\nand setting hu-\u003ehdev to NULL. This means incoming UART data will reach\nthe protocol-specific recv handler in hci_uart_tty_receive() after\nresources are freed.\n\nClear HCI_UART_PROTO_INIT with a write lock before calling\nhu-\u003eproto-\u003eclose() and setting hu-\u003ehdev to NULL. The write lock ensures\nall active readers have completed and no new reader can enter the\nprotocol recv path before resources are freed.\n\nThis allows the protocol-specific recv functions to remove the\n\"HCI_UART_REGISTERED\" guard without risking a null pointer dereference\nif hci_register_dev() fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:14.463Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07"
},
{
"url": "https://git.kernel.org/stable/c/ed4033fb85ccaaf6c3983be3c7b037e48253d232"
},
{
"url": "https://git.kernel.org/stable/c/356dee1bcac4d0d9152390561fa63331ebff211b"
},
{
"url": "https://git.kernel.org/stable/c/a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40"
},
{
"url": "https://git.kernel.org/stable/c/f4b69c35813c432973d340d3600c01de106ed474"
},
{
"url": "https://git.kernel.org/stable/c/3daa5818e473ed60eb69d8b5c71b651909d28c5a"
},
{
"url": "https://git.kernel.org/stable/c/194f029a4d7f739e44ebc1f473120187b4de5104"
},
{
"url": "https://git.kernel.org/stable/c/68d39ea5e0adc9ecaea1ce8abd842ec972eb8718"
}
],
"title": "Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53073",
"datePublished": "2026-06-24T16:30:14.463Z",
"dateReserved": "2026-06-09T07:44:35.383Z",
"dateUpdated": "2026-11-06T16:23:58.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43450 (GCVE-0-2026-43450)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-11-06 15:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label
inside the for loop body. When the "last" helper saved in cb->args[1]
is deleted between dump rounds, every entry fails the (cur != last)
check, so cb->args[1] is never cleared. The for loop finishes with
cb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back
into the loop body bypassing the bounds check, causing an 8-byte
out-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize].
The 'goto restart' block was meant to re-traverse the current bucket
when "last" is no longer found, but it was placed after the for loop
instead of inside it. Move the block into the for loop body so that
the restart only occurs while cb->args[0] is still within bounds.
BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0
Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131
Call Trace:
nfnl_cthelper_dump_table+0x9f/0x1b0
netlink_dump+0x333/0x880
netlink_recvmsg+0x3e2/0x4b0
sock_recvmsg+0xde/0xf0
__sys_recvfrom+0x150/0x200
__x64_sys_recvfrom+0x76/0x90
do_syscall_64+0xc3/0x6e0
Allocated by task 1:
__kvmalloc_node_noprof+0x21b/0x700
nf_ct_alloc_hashtable+0x65/0xd0
nf_conntrack_helper_init+0x21/0x60
nf_conntrack_init_start+0x18d/0x300
nf_conntrack_standalone_init+0x12/0xc0
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 12f7a505331e6b2754684b509f2ac8f0011ce644 Version: 12f7a505331e6b2754684b509f2ac8f0011ce644 Version: 12f7a505331e6b2754684b509f2ac8f0011ce644 Version: 12f7a505331e6b2754684b509f2ac8f0011ce644 Version: 12f7a505331e6b2754684b509f2ac8f0011ce644 Version: 12f7a505331e6b2754684b509f2ac8f0011ce644 Version: 12f7a505331e6b2754684b509f2ac8f0011ce644 Version: 12f7a505331e6b2754684b509f2ac8f0011ce644 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43450",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:39:14.413758Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:42:55.213Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nfnetlink_cthelper.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0605e1985a95d4334a67869aee45a47e82301abf",
"status": "affected",
"version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
"versionType": "git"
},
{
"lessThan": "92441f6d9405a0c18d03f278b395e782f79a4a30",
"status": "affected",
"version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
"versionType": "git"
},
{
"lessThan": "3cc328ffc32ddb389cba7b78b6aa95d995c2876e",
"status": "affected",
"version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
"versionType": "git"
},
{
"lessThan": "4a1f6ee69267a5f524102c028981410eeacfa3da",
"status": "affected",
"version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
"versionType": "git"
},
{
"lessThan": "894c5780ddadd5fde0e16f66587918e6be1504c4",
"status": "affected",
"version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
"versionType": "git"
},
{
"lessThan": "05018cd9370f77bb18fbf6e15ff33c7a06f10b3c",
"status": "affected",
"version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
"versionType": "git"
},
{
"lessThan": "61b3a1f8621df1a5928118313f133996f6a786db",
"status": "affected",
"version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
"versionType": "git"
},
{
"lessThan": "6dcee8496d53165b2d8a5909b3050b62ae71fe89",
"status": "affected",
"version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nfnetlink_cthelper.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()\n\nnfnl_cthelper_dump_table() has a \u0027goto restart\u0027 that jumps to a label\ninside the for loop body. When the \"last\" helper saved in cb-\u003eargs[1]\nis deleted between dump rounds, every entry fails the (cur != last)\ncheck, so cb-\u003eargs[1] is never cleared. The for loop finishes with\ncb-\u003eargs[0] == nf_ct_helper_hsize, and the \u0027goto restart\u0027 jumps back\ninto the loop body bypassing the bounds check, causing an 8-byte\nout-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize].\n\nThe \u0027goto restart\u0027 block was meant to re-traverse the current bucket\nwhen \"last\" is no longer found, but it was placed after the for loop\ninstead of inside it. Move the block into the for loop body so that\nthe restart only occurs while cb-\u003eargs[0] is still within bounds.\n\n BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0\n Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131\n Call Trace:\n nfnl_cthelper_dump_table+0x9f/0x1b0\n netlink_dump+0x333/0x880\n netlink_recvmsg+0x3e2/0x4b0\n sock_recvmsg+0xde/0xf0\n __sys_recvfrom+0x150/0x200\n __x64_sys_recvfrom+0x76/0x90\n do_syscall_64+0xc3/0x6e0\n\n Allocated by task 1:\n __kvmalloc_node_noprof+0x21b/0x700\n nf_ct_alloc_hashtable+0x65/0xd0\n nf_conntrack_helper_init+0x21/0x60\n nf_conntrack_init_start+0x18d/0x300\n nf_conntrack_standalone_init+0x12/0xc0"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:49.527Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0605e1985a95d4334a67869aee45a47e82301abf"
},
{
"url": "https://git.kernel.org/stable/c/92441f6d9405a0c18d03f278b395e782f79a4a30"
},
{
"url": "https://git.kernel.org/stable/c/3cc328ffc32ddb389cba7b78b6aa95d995c2876e"
},
{
"url": "https://git.kernel.org/stable/c/4a1f6ee69267a5f524102c028981410eeacfa3da"
},
{
"url": "https://git.kernel.org/stable/c/894c5780ddadd5fde0e16f66587918e6be1504c4"
},
{
"url": "https://git.kernel.org/stable/c/05018cd9370f77bb18fbf6e15ff33c7a06f10b3c"
},
{
"url": "https://git.kernel.org/stable/c/61b3a1f8621df1a5928118313f133996f6a786db"
},
{
"url": "https://git.kernel.org/stable/c/6dcee8496d53165b2d8a5909b3050b62ae71fe89"
}
],
"title": "netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43450",
"datePublished": "2026-05-08T14:22:15.915Z",
"dateReserved": "2026-05-01T14:12:56.010Z",
"dateUpdated": "2026-11-06T15:42:55.213Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90315 (GCVE-0-2026-90315)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-19 09:01
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers
Currently, the legacy I/O and memory sysfs handlers do not check
security_locked_down(LOCKDOWN_PCI_ACCESS), leaving the legacy_io and
legacy_mem files unprotected when the kernel is locked down.
Commit eb627e17727e ("PCI: Lock down BAR access when the kernel is locked
down") added the check to pci_write_config(), pci_mmap_resource(), and
pci_write_resource_io() to prevent userspace from programming DMA-capable
hardware that could be used to modify kernel code, but did not cover the
legacy handlers.
As a result, root can still write arbitrary I/O ports and map the legacy
I/O and memory spaces while the kernel is locked down, which is the same
capability the lockdown is meant to remove.
Add the same check to pci_write_legacy_io(), pci_mmap_legacy_mem(), and
pci_mmap_legacy_io().
These generic handlers cover both architectures that define HAVE_PCI_LEGACY
(such as Alpha and PowerPC).
[bhelgaas: add Link]
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/pci-sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3556caa31a2bfbc22c11b812fd4ed8851c2d7bff",
"status": "affected",
"version": "eb627e17727ebeede70697ae1798688b0d328b54",
"versionType": "git"
},
{
"lessThan": "cd07aef510ac6a2873e01f9ddddc5492490b0067",
"status": "affected",
"version": "eb627e17727ebeede70697ae1798688b0d328b54",
"versionType": "git"
},
{
"lessThan": "747b9bbbbdfdee51aee2456388f9b94b5086de4d",
"status": "affected",
"version": "eb627e17727ebeede70697ae1798688b0d328b54",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/pci-sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/sysfs: Add lockdown checks to legacy I/O and memory handlers\n\nCurrently, the legacy I/O and memory sysfs handlers do not check\nsecurity_locked_down(LOCKDOWN_PCI_ACCESS), leaving the legacy_io and\nlegacy_mem files unprotected when the kernel is locked down.\n\nCommit eb627e17727e (\"PCI: Lock down BAR access when the kernel is locked\ndown\") added the check to pci_write_config(), pci_mmap_resource(), and\npci_write_resource_io() to prevent userspace from programming DMA-capable\nhardware that could be used to modify kernel code, but did not cover the\nlegacy handlers.\n\nAs a result, root can still write arbitrary I/O ports and map the legacy\nI/O and memory spaces while the kernel is locked down, which is the same\ncapability the lockdown is meant to remove.\n\nAdd the same check to pci_write_legacy_io(), pci_mmap_legacy_mem(), and\npci_mmap_legacy_io().\n\nThese generic handlers cover both architectures that define HAVE_PCI_LEGACY\n(such as Alpha and PowerPC).\n\n[bhelgaas: add Link]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:01:31.722Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3556caa31a2bfbc22c11b812fd4ed8851c2d7bff"
},
{
"url": "https://git.kernel.org/stable/c/cd07aef510ac6a2873e01f9ddddc5492490b0067"
},
{
"url": "https://git.kernel.org/stable/c/747b9bbbbdfdee51aee2456388f9b94b5086de4d"
}
],
"title": "PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90315",
"datePublished": "2026-09-17T16:08:34.218Z",
"dateReserved": "2026-09-11T19:38:34.801Z",
"dateUpdated": "2026-10-19T09:01:31.722Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98403 (GCVE-0-2026-98403)
Vulnerability from cvelistv5
Published
2026-10-14 13:26
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/boot: Avoid IPL parameter append past command line
A command line may occupy all but the terminating byte of
COMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size
to the IPL parameter conversion helpers and points the destination one
byte past early_command_line. The helpers subtract one from the unsigned
size and write the converted parameter outside the command line buffer.
Convert the IPL parameter in the command line parsing buffer first. A
parameter beginning with '=' can then replace the existing command line
regardless of its length, while other parameters are appended only when
space remains.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/boot/ipl_parm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af9866021a00ab9eeacf0c33ee73f3d134b4ed70",
"status": "affected",
"version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2",
"versionType": "git"
},
{
"lessThan": "73eec5a0d55916d7e1115f5d03a7ffc06d6215cf",
"status": "affected",
"version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2",
"versionType": "git"
},
{
"lessThan": "8d11bfec8666f8409fac9072e9c25b691d3e30ac",
"status": "affected",
"version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2",
"versionType": "git"
},
{
"lessThan": "d76181dfabdaa720703167393704efacba343442",
"status": "affected",
"version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/boot/ipl_parm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/boot: Avoid IPL parameter append past command line\n\nA command line may occupy all but the terminating byte of\nCOMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size\nto the IPL parameter conversion helpers and points the destination one\nbyte past early_command_line. The helpers subtract one from the unsigned\nsize and write the converted parameter outside the command line buffer.\n\nConvert the IPL parameter in the command line parsing buffer first. A\nparameter beginning with \u0027=\u0027 can then replace the existing command line\nregardless of its length, while other parameters are appended only when\nspace remains."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:56.682Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af9866021a00ab9eeacf0c33ee73f3d134b4ed70"
},
{
"url": "https://git.kernel.org/stable/c/73eec5a0d55916d7e1115f5d03a7ffc06d6215cf"
},
{
"url": "https://git.kernel.org/stable/c/8d11bfec8666f8409fac9072e9c25b691d3e30ac"
},
{
"url": "https://git.kernel.org/stable/c/d76181dfabdaa720703167393704efacba343442"
}
],
"title": "s390/boot: Avoid IPL parameter append past command line",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98403",
"datePublished": "2026-10-14T13:26:02.916Z",
"dateReserved": "2026-09-25T10:25:14.347Z",
"dateUpdated": "2026-10-19T09:18:56.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71066 (GCVE-0-2025-71066)
Vulnerability from cvelistv5
Published
2026-01-13 15:31
Modified
2026-08-05 12:11
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change
zdi-disclosures@trendmicro.com says:
The vulnerability is a race condition between `ets_qdisc_dequeue` and
`ets_qdisc_change`. It leads to UAF on `struct Qdisc` object.
Attacker requires the capability to create new user and network namespace
in order to trigger the bug.
See my additional commentary at the end of the analysis.
Analysis:
static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt,
struct netlink_ext_ack *extack)
{
...
// (1) this lock is preventing .change handler (`ets_qdisc_change`)
//to race with .dequeue handler (`ets_qdisc_dequeue`)
sch_tree_lock(sch);
for (i = nbands; i < oldbands; i++) {
if (i >= q->nstrict && q->classes[i].qdisc->q.qlen)
list_del_init(&q->classes[i].alist);
qdisc_purge_queue(q->classes[i].qdisc);
}
WRITE_ONCE(q->nbands, nbands);
for (i = nstrict; i < q->nstrict; i++) {
if (q->classes[i].qdisc->q.qlen) {
// (2) the class is added to the q->active
list_add_tail(&q->classes[i].alist, &q->active);
q->classes[i].deficit = quanta[i];
}
}
WRITE_ONCE(q->nstrict, nstrict);
memcpy(q->prio2band, priomap, sizeof(priomap));
for (i = 0; i < q->nbands; i++)
WRITE_ONCE(q->classes[i].quantum, quanta[i]);
for (i = oldbands; i < q->nbands; i++) {
q->classes[i].qdisc = queues[i];
if (q->classes[i].qdisc != &noop_qdisc)
qdisc_hash_add(q->classes[i].qdisc, true);
}
// (3) the qdisc is unlocked, now dequeue can be called in parallel
// to the rest of .change handler
sch_tree_unlock(sch);
ets_offload_change(sch);
for (i = q->nbands; i < oldbands; i++) {
// (4) we're reducing the refcount for our class's qdisc and
// freeing it
qdisc_put(q->classes[i].qdisc);
// (5) If we call .dequeue between (4) and (5), we will have
// a strong UAF and we can control RIP
q->classes[i].qdisc = NULL;
WRITE_ONCE(q->classes[i].quantum, 0);
q->classes[i].deficit = 0;
gnet_stats_basic_sync_init(&q->classes[i].bstats);
memset(&q->classes[i].qstats, 0, sizeof(q->classes[i].qstats));
}
return 0;
}
Comment:
This happens because some of the classes have their qdiscs assigned to
NULL, but remain in the active list. This commit fixes this issue by always
removing the class from the active list before deleting and freeing its
associated qdisc
Reproducer Steps
(trimmed version of what was sent by zdi-disclosures@trendmicro.com)
```
DEV="${DEV:-lo}"
ROOT_HANDLE="${ROOT_HANDLE:-1:}"
BAND2_HANDLE="${BAND2_HANDLE:-20:}" # child under 1:2
PING_BYTES="${PING_BYTES:-48}"
PING_COUNT="${PING_COUNT:-200000}"
PING_DST="${PING_DST:-127.0.0.1}"
SLOW_TBF_RATE="${SLOW_TBF_RATE:-8bit}"
SLOW_TBF_BURST="${SLOW_TBF_BURST:-100b}"
SLOW_TBF_LAT="${SLOW_TBF_LAT:-1s}"
cleanup() {
tc qdisc del dev "$DEV" root 2>/dev/null
}
trap cleanup EXIT
ip link set "$DEV" up
tc qdisc del dev "$DEV" root 2>/dev/null || true
tc qdisc add dev "$DEV" root handle "$ROOT_HANDLE" ets bands 2 strict 2
tc qdisc add dev "$DEV" parent 1:2 handle "$BAND2_HANDLE" \
tbf rate "$SLOW_TBF_RATE" burst "$SLOW_TBF_BURST" latency "$SLOW_TBF_LAT"
tc filter add dev "$DEV" parent 1: protocol all prio 1 u32 match u32 0 0 flowid 1:2
tc -s qdisc ls dev $DEV
ping -I "$DEV" -f -c "$PING_COUNT" -s "$PING_BYTES" -W 0.001 "$PING_DST" \
>/dev/null 2>&1 &
tc qdisc change dev "$DEV" root handle "$ROOT_HANDLE" ets bands 2 strict 0
tc qdisc change dev "$DEV" root handle "$ROOT_HANDLE" ets bands 2 strict 2
tc -s qdisc ls dev $DEV
tc qdisc del dev "$DEV" parent
---truncated---
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ae2659d2c670252759ee9c823c4e039c0e05a6f2 Version: e25bdbc7e951ae5728fee1f4c09485df113d013c Version: de6d25924c2a8c2988c6a385990cafbe742061bf Version: de6d25924c2a8c2988c6a385990cafbe742061bf Version: de6d25924c2a8c2988c6a385990cafbe742061bf Version: de6d25924c2a8c2988c6a385990cafbe742061bf Version: de6d25924c2a8c2988c6a385990cafbe742061bf Version: 5.10.83 ≤ Version: 5.15.6 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-71066",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-22T03:55:51.470582Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-22T12:50:15.711Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/sch_ets.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "062d5d544e564473450d72e6af83077c2b2ff7c3",
"status": "affected",
"version": "ae2659d2c670252759ee9c823c4e039c0e05a6f2",
"versionType": "git"
},
{
"lessThan": "c7f6e7cc14df72b997258216e99d897d2df0dbbd",
"status": "affected",
"version": "e25bdbc7e951ae5728fee1f4c09485df113d013c",
"versionType": "git"
},
{
"lessThan": "a75d617a4ef08682f5cfaadc01d5141c87e019c9",
"status": "affected",
"version": "de6d25924c2a8c2988c6a385990cafbe742061bf",
"versionType": "git"
},
{
"lessThan": "9987cda315c08f63a02423fa2f9a1f6602c861a0",
"status": "affected",
"version": "de6d25924c2a8c2988c6a385990cafbe742061bf",
"versionType": "git"
},
{
"lessThan": "06bfb66a7c8b45e3fed01351a4b087410ae5ef39",
"status": "affected",
"version": "de6d25924c2a8c2988c6a385990cafbe742061bf",
"versionType": "git"
},
{
"lessThan": "45466141da3c98a0c5fa88be0bc14b4b6a4bd75c",
"status": "affected",
"version": "de6d25924c2a8c2988c6a385990cafbe742061bf",
"versionType": "git"
},
{
"lessThan": "ce052b9402e461a9aded599f5b47e76bc727f7de",
"status": "affected",
"version": "de6d25924c2a8c2988c6a385990cafbe742061bf",
"versionType": "git"
},
{
"lessThan": "5.10.248",
"status": "affected",
"version": "5.10.83",
"versionType": "semver"
},
{
"lessThan": "5.15.198",
"status": "affected",
"version": "5.15.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/sch_ets.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.248",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.198",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.248",
"versionStartIncluding": "5.10.83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.198",
"versionStartIncluding": "5.15.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.160",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.120",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.64",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.3",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: ets: Always remove class from active list before deleting in ets_qdisc_change\n\nzdi-disclosures@trendmicro.com says:\n\nThe vulnerability is a race condition between `ets_qdisc_dequeue` and\n`ets_qdisc_change`. It leads to UAF on `struct Qdisc` object.\nAttacker requires the capability to create new user and network namespace\nin order to trigger the bug.\nSee my additional commentary at the end of the analysis.\n\nAnalysis:\n\nstatic int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt,\n struct netlink_ext_ack *extack)\n{\n...\n\n // (1) this lock is preventing .change handler (`ets_qdisc_change`)\n //to race with .dequeue handler (`ets_qdisc_dequeue`)\n sch_tree_lock(sch);\n\n for (i = nbands; i \u003c oldbands; i++) {\n if (i \u003e= q-\u003enstrict \u0026\u0026 q-\u003eclasses[i].qdisc-\u003eq.qlen)\n list_del_init(\u0026q-\u003eclasses[i].alist);\n qdisc_purge_queue(q-\u003eclasses[i].qdisc);\n }\n\n WRITE_ONCE(q-\u003enbands, nbands);\n for (i = nstrict; i \u003c q-\u003enstrict; i++) {\n if (q-\u003eclasses[i].qdisc-\u003eq.qlen) {\n\t\t // (2) the class is added to the q-\u003eactive\n list_add_tail(\u0026q-\u003eclasses[i].alist, \u0026q-\u003eactive);\n q-\u003eclasses[i].deficit = quanta[i];\n }\n }\n WRITE_ONCE(q-\u003enstrict, nstrict);\n memcpy(q-\u003eprio2band, priomap, sizeof(priomap));\n\n for (i = 0; i \u003c q-\u003enbands; i++)\n WRITE_ONCE(q-\u003eclasses[i].quantum, quanta[i]);\n\n for (i = oldbands; i \u003c q-\u003enbands; i++) {\n q-\u003eclasses[i].qdisc = queues[i];\n if (q-\u003eclasses[i].qdisc != \u0026noop_qdisc)\n qdisc_hash_add(q-\u003eclasses[i].qdisc, true);\n }\n\n // (3) the qdisc is unlocked, now dequeue can be called in parallel\n // to the rest of .change handler\n sch_tree_unlock(sch);\n\n ets_offload_change(sch);\n for (i = q-\u003enbands; i \u003c oldbands; i++) {\n\t // (4) we\u0027re reducing the refcount for our class\u0027s qdisc and\n\t // freeing it\n qdisc_put(q-\u003eclasses[i].qdisc);\n\t // (5) If we call .dequeue between (4) and (5), we will have\n\t // a strong UAF and we can control RIP\n q-\u003eclasses[i].qdisc = NULL;\n WRITE_ONCE(q-\u003eclasses[i].quantum, 0);\n q-\u003eclasses[i].deficit = 0;\n gnet_stats_basic_sync_init(\u0026q-\u003eclasses[i].bstats);\n memset(\u0026q-\u003eclasses[i].qstats, 0, sizeof(q-\u003eclasses[i].qstats));\n }\n return 0;\n}\n\nComment:\nThis happens because some of the classes have their qdiscs assigned to\nNULL, but remain in the active list. This commit fixes this issue by always\nremoving the class from the active list before deleting and freeing its\nassociated qdisc\n\nReproducer Steps\n(trimmed version of what was sent by zdi-disclosures@trendmicro.com)\n\n```\nDEV=\"${DEV:-lo}\"\nROOT_HANDLE=\"${ROOT_HANDLE:-1:}\"\nBAND2_HANDLE=\"${BAND2_HANDLE:-20:}\" # child under 1:2\nPING_BYTES=\"${PING_BYTES:-48}\"\nPING_COUNT=\"${PING_COUNT:-200000}\"\nPING_DST=\"${PING_DST:-127.0.0.1}\"\n\nSLOW_TBF_RATE=\"${SLOW_TBF_RATE:-8bit}\"\nSLOW_TBF_BURST=\"${SLOW_TBF_BURST:-100b}\"\nSLOW_TBF_LAT=\"${SLOW_TBF_LAT:-1s}\"\n\ncleanup() {\n tc qdisc del dev \"$DEV\" root 2\u003e/dev/null\n}\ntrap cleanup EXIT\n\nip link set \"$DEV\" up\n\ntc qdisc del dev \"$DEV\" root 2\u003e/dev/null || true\n\ntc qdisc add dev \"$DEV\" root handle \"$ROOT_HANDLE\" ets bands 2 strict 2\n\ntc qdisc add dev \"$DEV\" parent 1:2 handle \"$BAND2_HANDLE\" \\\n tbf rate \"$SLOW_TBF_RATE\" burst \"$SLOW_TBF_BURST\" latency \"$SLOW_TBF_LAT\"\n\ntc filter add dev \"$DEV\" parent 1: protocol all prio 1 u32 match u32 0 0 flowid 1:2\ntc -s qdisc ls dev $DEV\n\nping -I \"$DEV\" -f -c \"$PING_COUNT\" -s \"$PING_BYTES\" -W 0.001 \"$PING_DST\" \\\n \u003e/dev/null 2\u003e\u00261 \u0026\ntc qdisc change dev \"$DEV\" root handle \"$ROOT_HANDLE\" ets bands 2 strict 0\ntc qdisc change dev \"$DEV\" root handle \"$ROOT_HANDLE\" ets bands 2 strict 2\ntc -s qdisc ls dev $DEV\ntc qdisc del dev \"$DEV\" parent \n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local rtnetlink qdisc configuration and locally generated traffic reaching the ETS dequeue path.\nAC:L - The attacker controls both racing paths by issuing qdisc changes while driving packet dequeue, and can deterministically create the stale active-list state. Although the UAF window is narrow, preemptible, RT, or virtualized scheduling makes it plausible, and the higher-severity tie-break requires L.\nPR:L - RTM_NEWQDISC requires CAP_NET_ADMIN in the target network namespace. An unprivileged user can obtain that capability by creating user and network namespaces on deployments permitting unprivileged user namespaces.\nUI:N - No victim action is required after the attacker configures ETS and generates concurrent traffic.\nS:U - The corruption and resulting kernel compromise occur within the Linux kernel\u2019s existing security authority; standard namespace escape or kernel privilege escalation does not change CVSS scope.\nC:H - The freed Qdisc can be reclaimed with attacker-influenced contents and dereferenced through its operations pointer, supporting kernel memory disclosure primitives.\nI:H - The UAF reaches an indirect peek function call through the freed Qdisc operations pointer, making control-flow hijacking and arbitrary kernel modification defensible.\nA:H - The flaw demonstrably causes a KASAN use-after-free or NULL-pointer kernel oops and can produce a kernel panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:11:49.113Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/062d5d544e564473450d72e6af83077c2b2ff7c3"
},
{
"url": "https://git.kernel.org/stable/c/c7f6e7cc14df72b997258216e99d897d2df0dbbd"
},
{
"url": "https://git.kernel.org/stable/c/a75d617a4ef08682f5cfaadc01d5141c87e019c9"
},
{
"url": "https://git.kernel.org/stable/c/9987cda315c08f63a02423fa2f9a1f6602c861a0"
},
{
"url": "https://git.kernel.org/stable/c/06bfb66a7c8b45e3fed01351a4b087410ae5ef39"
},
{
"url": "https://git.kernel.org/stable/c/45466141da3c98a0c5fa88be0bc14b4b6a4bd75c"
},
{
"url": "https://git.kernel.org/stable/c/ce052b9402e461a9aded599f5b47e76bc727f7de"
}
],
"title": "net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-71066",
"datePublished": "2026-01-13T15:31:21.931Z",
"dateReserved": "2026-01-13T15:30:19.646Z",
"dateUpdated": "2026-08-05T12:11:49.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72098 (GCVE-0-2026-72098)
Vulnerability from cvelistv5
Published
2026-08-15 05:52
Modified
2026-10-30 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-verity: fix buffer overflow in FEC calculation
There's a buffer overflow in dm-verity-fec:
if (neras && *neras <= v->fec->roots)
fio->erasures[(*neras)++] = i;
This allows *neras to reach roots + 1 (the post-increment pushes it past
roots). This value is then passed as no_eras to decode_rs8(). Inside the
RS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator
polynomial loop writes lambda[j] where j can reach nroots + 1 — one
element past the end of lambda[] (which is sized nroots + 1, valid
indices 0..nroots). The out-of-bounds write lands on syn[0], corrupting
the syndrome buffer.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72098",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:51:49.534768Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:19:27.528Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-verity-fec.c",
"drivers/md/dm-verity-fec.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "84d4d2a6988c9a733f7821452cefb5b0d93de2d1",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
},
{
"lessThan": "374775626c327aec2425c16b4d36706e5f8718b8",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
},
{
"lessThan": "dc662eed1c432cc2fd4e9314f58d30b3a8cca7cc",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
},
{
"lessThan": "5488d3a69d205e28f74f18857b853aa12e778e66",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
},
{
"lessThan": "f7990c2b0f08b8841fcd2652d1d7002f5994a7a7",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
},
{
"lessThan": "31d6e6c0ba8d5a7bd59660035a089307100c5e8e",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-verity-fec.c",
"drivers/md/dm-verity-fec.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity: fix buffer overflow in FEC calculation\n\nThere\u0027s a buffer overflow in dm-verity-fec:\n\nif (neras \u0026\u0026 *neras \u003c= v-\u003efec-\u003eroots)\n\tfio-\u003eerasures[(*neras)++] = i;\n\nThis allows *neras to reach roots + 1 (the post-increment pushes it past\nroots). This value is then passed as no_eras to decode_rs8(). Inside the\nRS decoder (lib/reed_solomon/decode_rs.c:113-121), the erasure locator\npolynomial loop writes lambda[j] where j can reach nroots + 1 \u2014 one\nelement past the end of lambda[] (which is sized nroots + 1, valid\nindices 0..nroots). The out-of-bounds write lands on syn[0], corrupting\nthe syndrome buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - In cloud/network-boot deployments where dm-verity data, hash, or FEC backing devices are served over NBD/iSCSI/TCP, a remote block provider can supply crafted blocks that drive the FEC erasure-correction path during ordinary read I/O through verity_map without local code execution.\nAC:L - A crafted backing image or malicious network-block responses can deterministically produce at least fec_roots+1 hash-mismatched or failed message blocks in one RS group, reliably reaching the off-by-one no_eras path on the second FEC decode attempt after verification failure.\nPR:N - Triggering requires only read I/O against an active dm-verity+FEC mapping; a remote NBD/iSCSI peer needs no account or privileges on the victim host, and unprivileged local processes with read access to the mapped device or filesystem can also reach the vulnerable FEC path.\nUI:N - Exploitation is driven by automatic boot-time reads, udev probing, or ordinary filesystem I/O on the dm-verity device; no specific victim action beyond normal system operation is required once corruption is present.\nS:U - The overflow corrupts kernel heap Reed-Solomon scratch buffers during dm-verity verification within the same kernel security authority; it does not by itself cross VM, IOMMU, or sandbox boundaries.\nC:H - The inflated no_eras value causes decode_rs8 to XOR-write one uint16 past lambda[] into syn[0], corrupting adjacent kernel decoder state; such heap out-of-bounds writes can be leveraged for arbitrary memory disclosure.\nI:H - The same out-of-bounds write in the erasure-locator loop corrupts syndrome buffers later used to modify decoded message bytes, providing a heap memory-corruption primitive that can enable arbitrary kernel writes or control-flow hijacking.\nA:H - Corrupting Reed-Solomon decoder state during dm-verity verification can cause kernel oops, panics, or hung I/O on critical read-only partitions (notably Android/embedded systems with FEC enabled), denying availability of the device or entire system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:28:46.939Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/84d4d2a6988c9a733f7821452cefb5b0d93de2d1"
},
{
"url": "https://git.kernel.org/stable/c/374775626c327aec2425c16b4d36706e5f8718b8"
},
{
"url": "https://git.kernel.org/stable/c/dc662eed1c432cc2fd4e9314f58d30b3a8cca7cc"
},
{
"url": "https://git.kernel.org/stable/c/5488d3a69d205e28f74f18857b853aa12e778e66"
},
{
"url": "https://git.kernel.org/stable/c/f7990c2b0f08b8841fcd2652d1d7002f5994a7a7"
},
{
"url": "https://git.kernel.org/stable/c/31d6e6c0ba8d5a7bd59660035a089307100c5e8e"
}
],
"title": "dm-verity: fix buffer overflow in FEC calculation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72098",
"datePublished": "2026-08-15T05:52:43.666Z",
"dateReserved": "2026-08-09T03:40:39.905Z",
"dateUpdated": "2026-10-30T12:28:46.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89479 (GCVE-0-2026-89479)
Vulnerability from cvelistv5
Published
2026-09-11 19:43
Modified
2026-10-19 08:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: stop processing a packet once its association is deleted
sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is
NULL, and caches the result in chunk->asoc and chunk->transport without
taking a reference.
A packet that matches no association is handed to the endpoint, so a peer
can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK in one packet. The
COOKIE ECHO creates the association, the SHUTDOWN chunk caches it, and
with the outqueue empty the SHUTDOWN ACK reaches sctp_sf_do_9_2_final(),
so the association and its transports are freed.
The endpoint loop has no counterpart to the asoc->base.dead check in
sctp_assoc_bh_rcv(). The next chunk writes to last_time_heard in the freed
transport and is then passed to sctp_do_sm() with the freed association.
The transport is freed through RCU, so this needs the packet to come off
the socket backlog, where the loop runs in task context.
The endpoint loop cannot do the same check: it holds no reference on the
association, so reading asoc->base.dead would itself be a use-after-free.
Mark the packet for discard in the command interpreter, just before it
deletes the association. That is also before sctp_inq_free() releases the
chunk on the association receive path.
sctp_sf_do_5_2_4_dupcook() issues SCTP_CMD_DELETE_TCB for the temporary
association, while the one the packet belongs to stays alive. A restarting
peer can bundle DATA behind its COOKIE ECHO, so compare against
chunk->asoc and leave that case alone.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89479",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:22:28.838638Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:39.390Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_sideeffect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7d970353eeb98f46a3b9dc602850e4f6336a9889",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "09c3b193a3e8fe53e1f416e2f8e3283d2a785405",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ed85fe91a61bc0e0da6b585c07102b20f4cc65a0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5c0b2dbbdafc9eeeb11fffe1e46551fc3b55d8ee",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ee3f04cf566f6041aa9a0360494fd8db5ade383a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "fa306a40e716c5abcd967475459ce1ebd56e5115",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a713e1b3a265f180ad25a08e17be15d67a2f7149",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "47e15a8d12e366d0d261bcbc394394f44418938d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_sideeffect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: stop processing a packet once its association is deleted\n\nsctp_endpoint_bh_rcv() looks the association up only when chunk-\u003easoc is\nNULL, and caches the result in chunk-\u003easoc and chunk-\u003etransport without\ntaking a reference.\n\nA packet that matches no association is handed to the endpoint, so a peer\ncan bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK in one packet. The\nCOOKIE ECHO creates the association, the SHUTDOWN chunk caches it, and\nwith the outqueue empty the SHUTDOWN ACK reaches sctp_sf_do_9_2_final(),\nso the association and its transports are freed.\n\nThe endpoint loop has no counterpart to the asoc-\u003ebase.dead check in\nsctp_assoc_bh_rcv(). The next chunk writes to last_time_heard in the freed\ntransport and is then passed to sctp_do_sm() with the freed association.\nThe transport is freed through RCU, so this needs the packet to come off\nthe socket backlog, where the loop runs in task context.\n\nThe endpoint loop cannot do the same check: it holds no reference on the\nassociation, so reading asoc-\u003ebase.dead would itself be a use-after-free.\nMark the packet for discard in the command interpreter, just before it\ndeletes the association. That is also before sctp_inq_free() releases the\nchunk on the association receive path.\n\nsctp_sf_do_5_2_4_dupcook() issues SCTP_CMD_DELETE_TCB for the temporary\nassociation, while the one the packet belongs to stays alive. A restarting\npeer can bundle DATA behind its COOKIE ECHO, so compare against\nchunk-\u003easoc and leave that case alone."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The UAF is reached from sctp_rcv() when a remote peer sends a bundled SCTP packet (COOKIE-ECHO, SHUTDOWN, SHUTDOWN-ACK, then another chunk) to a listening internet-facing SCTP endpoint; no local syscall or link-local medium is required.\nAC:L - The attacker fully controls the four-way handshake and the bundled chunk order that creates, caches, then deletes the association in one packet; forcing that packet onto the socket backlog is done with concurrent associations or recv/accept load the attacker generates, with no victim-only race.\nPR:N - COOKIE-ECHO is the unauthenticated SCTP handshake completion using only the INIT-ACK cookie as anti-spoofing; a network peer needs no Linux account, capability, or namespace privilege on the victim host.\nUI:N - The kernel automatically processes inbound SCTP chunks in sctp_endpoint_bh_rcv()/sctp_do_sm(); no victim mount, file open, or other interactive action is required.\nS:U - Impact is kernel heap use-after-free of sctp_association/sctp_transport on the host; it does not cross a VM, container, or IOMMU boundary.\nC:H - After DELETE_TCB the next bundled chunk reads freed asoc-\u003estate and other association fields and is passed into sctp_do_sm(); UAF of these slab objects enables heap grooming for arbitrary kernel disclosure.\nI:H - The same loop writes last_time_heard on the RCU-freed transport and mutates freed asoc fields (stats, last_data_from) before sctp_do_sm() runs with the dangling pointer, yielding a standard UAF write/control-flow primitive.\nA:H - Dereferencing the freed association and transport in the endpoint receive loop can oops or panic the kernel, and a remote peer can repeat the bundled packet against any listening SCTP service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:47:28.375Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7d970353eeb98f46a3b9dc602850e4f6336a9889"
},
{
"url": "https://git.kernel.org/stable/c/09c3b193a3e8fe53e1f416e2f8e3283d2a785405"
},
{
"url": "https://git.kernel.org/stable/c/ed85fe91a61bc0e0da6b585c07102b20f4cc65a0"
},
{
"url": "https://git.kernel.org/stable/c/5c0b2dbbdafc9eeeb11fffe1e46551fc3b55d8ee"
},
{
"url": "https://git.kernel.org/stable/c/ee3f04cf566f6041aa9a0360494fd8db5ade383a"
},
{
"url": "https://git.kernel.org/stable/c/fa306a40e716c5abcd967475459ce1ebd56e5115"
},
{
"url": "https://git.kernel.org/stable/c/a713e1b3a265f180ad25a08e17be15d67a2f7149"
},
{
"url": "https://git.kernel.org/stable/c/47e15a8d12e366d0d261bcbc394394f44418938d"
}
],
"title": "sctp: stop processing a packet once its association is deleted",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89479",
"datePublished": "2026-09-11T19:43:35.263Z",
"dateReserved": "2026-09-11T19:38:34.711Z",
"dateUpdated": "2026-10-19T08:47:28.375Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39797 (GCVE-0-2025-39797)
Vulnerability from cvelistv5
Published
2025-09-12 15:59
Modified
2026-11-05 21:12
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: Duplicate SPI Handling
The issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI
Netlink message, which triggers the kernel function xfrm_alloc_spi().
This function is expected to ensure uniqueness of the Security Parameter
Index (SPI) for inbound Security Associations (SAs). However, it can
return success even when the requested SPI is already in use, leading
to duplicate SPIs assigned to multiple inbound SAs, differentiated
only by their destination addresses.
This behavior causes inconsistencies during SPI lookups for inbound packets.
Since the lookup may return an arbitrary SA among those with the same SPI,
packet processing can fail, resulting in packet drops.
According to RFC 4301 section 4.4.2 , for inbound processing a unicast SA
is uniquely identified by the SPI and optionally protocol.
Reproducing the Issue Reliably:
To consistently reproduce the problem, restrict the available SPI range in
charon.conf : spi_min = 0x10000000 spi_max = 0x10000002
This limits the system to only 2 usable SPI values.
Next, create more than 2 Child SA. each using unique pair of src/dst address.
As soon as the 3rd Child SA is initiated, it will be assigned a duplicate
SPI, since the SPI pool is already exhausted.
With a narrow SPI range, the issue is consistently reproducible.
With a broader/default range, it becomes rare and unpredictable.
Current implementation:
xfrm_spi_hash() lookup function computes hash using daddr, proto, and family.
So if two SAs have the same SPI but different destination addresses, then
they will:
a. Hash into different buckets
b. Be stored in different linked lists (byspi + h)
c. Not be seen in the same hlist_for_each_entry_rcu() iteration.
As a result, the lookup will result in NULL and kernel allows that Duplicate SPI
Proposed Change:
xfrm_state_lookup_spi_proto() does a truly global search - across all states,
regardless of hash bucket and matches SPI and proto.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-39797",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:11:40.818580Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:12:58.578Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fb58962aa3b9359988c7b5b15a971fd9ad5b0ecd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3d8090bb53424432fa788fe9a49e8ceca74f0544",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2fc5b54368a1bf1d2d74b4d3b8eea5309a653e38",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c67d4e7a8f90fb6361ca89d4d5c9a28f4e935e47",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "29e9158f91f99057dbd35db5e8674d93b38549fe",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "94f39804d891cffe4ce17737d295f3b195bc7299",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.43",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.103",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.43",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.11",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Duplicate SPI Handling\n\nThe issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI\nNetlink message, which triggers the kernel function xfrm_alloc_spi().\nThis function is expected to ensure uniqueness of the Security Parameter\nIndex (SPI) for inbound Security Associations (SAs). However, it can\nreturn success even when the requested SPI is already in use, leading\nto duplicate SPIs assigned to multiple inbound SAs, differentiated\nonly by their destination addresses.\n\nThis behavior causes inconsistencies during SPI lookups for inbound packets.\nSince the lookup may return an arbitrary SA among those with the same SPI,\npacket processing can fail, resulting in packet drops.\n\nAccording to RFC 4301 section 4.4.2 , for inbound processing a unicast SA\nis uniquely identified by the SPI and optionally protocol.\n\nReproducing the Issue Reliably:\nTo consistently reproduce the problem, restrict the available SPI range in\ncharon.conf : spi_min = 0x10000000 spi_max = 0x10000002\nThis limits the system to only 2 usable SPI values.\nNext, create more than 2 Child SA. each using unique pair of src/dst address.\nAs soon as the 3rd Child SA is initiated, it will be assigned a duplicate\nSPI, since the SPI pool is already exhausted.\nWith a narrow SPI range, the issue is consistently reproducible.\nWith a broader/default range, it becomes rare and unpredictable.\n\nCurrent implementation:\nxfrm_spi_hash() lookup function computes hash using daddr, proto, and family.\nSo if two SAs have the same SPI but different destination addresses, then\nthey will:\na. Hash into different buckets\nb. Be stored in different linked lists (byspi + h)\nc. Not be seen in the same hlist_for_each_entry_rcu() iteration.\nAs a result, the lookup will result in NULL and kernel allows that Duplicate SPI\n\nProposed Change:\nxfrm_state_lookup_spi_proto() does a truly global search - across all states,\nregardless of hash bucket and matches SPI and proto."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:22:28.883Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fb58962aa3b9359988c7b5b15a971fd9ad5b0ecd"
},
{
"url": "https://git.kernel.org/stable/c/3d8090bb53424432fa788fe9a49e8ceca74f0544"
},
{
"url": "https://git.kernel.org/stable/c/2fc5b54368a1bf1d2d74b4d3b8eea5309a653e38"
},
{
"url": "https://git.kernel.org/stable/c/c67d4e7a8f90fb6361ca89d4d5c9a28f4e935e47"
},
{
"url": "https://git.kernel.org/stable/c/29e9158f91f99057dbd35db5e8674d93b38549fe"
},
{
"url": "https://git.kernel.org/stable/c/94f39804d891cffe4ce17737d295f3b195bc7299"
}
],
"title": "xfrm: Duplicate SPI Handling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39797",
"datePublished": "2025-09-12T15:59:33.639Z",
"dateReserved": "2025-04-16T07:20:57.132Z",
"dateUpdated": "2026-11-05T21:12:58.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64007 (GCVE-0-2026-64007)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: synproxy: refresh tcphdr after skb_ensure_writable
synproxy_tstamp_adjust() rewrites the TCP timestamp option in place
and then patches the TCP checksum via inet_proto_csum_replace4() on
the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and
ipv6_synproxy_hook() obtain that pointer with skb_header_pointer()
before calling in, so it may either alias skb->head directly or
point at the caller's on-stack _tcph buffer.
Between obtaining the pointer and using it, the function calls
skb_ensure_writable(skb, optend), which on a cloned or non-linear
skb invokes pskb_expand_head() and frees the old skb->head. After
that point the cached th is stale:
caller (ipv[46]_synproxy_hook)
th = skb_header_pointer(skb, ..., &_tcph)
synproxy_tstamp_adjust(skb, protoff, th, ...)
skb_ensure_writable(skb, optend)
pskb_expand_head() /* kfree(old skb->head) */
...
inet_proto_csum_replace4(&th->check, ...)
/* writes into freed head, or
into the caller's stack copy
leaving the on-wire checksum
stale */
The option bytes are written through skb->data and are fine; only
the checksum update goes through th and so lands in the wrong
place. The result is either a write into freed slab memory or a
packet leaving with a checksum that does not match its payload.
Fix by re-deriving th from skb->data + protoff immediately after
skb_ensure_writable() succeeds, so the subsequent checksum update
targets the linear, writable header.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64007",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:35:12.812094Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:08.086Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_synproxy_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9902a1058992de5d95656b64a3bd95c077f7ba2c",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "d3019c61799adc21811af4b521f11f3dc77f8e04",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "dd206819f210522579010d889d45a9530bb494bc",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "af2c22ccb1f621aff487ff47a040e38e058541e7",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "c7f945f7da097245a2f8ed7775ce48421047ee96",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "f0fea2b6d5453a11ad11713bbf37561b9b3a7edf",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "a91887a5b6ee4b98dfbf1db657ed2b879430149e",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "92170e6afe927ab2792a3f71902845789c8e31b1",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_synproxy_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.12"
},
{
"lessThan": "3.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: refresh tcphdr after skb_ensure_writable\n\nsynproxy_tstamp_adjust() rewrites the TCP timestamp option in place\nand then patches the TCP checksum via inet_proto_csum_replace4() on\nthe caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and\nipv6_synproxy_hook() obtain that pointer with skb_header_pointer()\nbefore calling in, so it may either alias skb-\u003ehead directly or\npoint at the caller\u0027s on-stack _tcph buffer.\n\nBetween obtaining the pointer and using it, the function calls\nskb_ensure_writable(skb, optend), which on a cloned or non-linear\nskb invokes pskb_expand_head() and frees the old skb-\u003ehead. After\nthat point the cached th is stale:\n\n caller (ipv[46]_synproxy_hook)\n th = skb_header_pointer(skb, ..., \u0026_tcph)\n synproxy_tstamp_adjust(skb, protoff, th, ...)\n skb_ensure_writable(skb, optend)\n pskb_expand_head() /* kfree(old skb-\u003ehead) */\n ...\n inet_proto_csum_replace4(\u0026th-\u003echeck, ...)\n /* writes into freed head, or\n into the caller\u0027s stack copy\n leaving the on-wire checksum\n stale */\n\nThe option bytes are written through skb-\u003edata and are fine; only\nthe checksum update goes through th and so lands in the wrong\nplace. The result is either a write into freed slab memory or a\npacket leaving with a checksum that does not match its payload.\n\nFix by re-deriving th from skb-\u003edata + protoff immediately after\nskb_ensure_writable() succeeds, so the subsequent checksum update\ntargets the linear, writable header."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is triggered when remote TCP packets traverse SYNPROXY netfilter hooks (NF_INET_LOCAL_IN / NF_INET_POST_ROUTING) on a host with SYNPROXY configured, which is the standard internet-facing firewall/router deployment for this subsystem.\nAC:L - An attacker who controls a TCP session through SYNPROXY can reliably send timestamp-bearing packets to hit the vulnerable path; the stale-pointer UAF write occurs whenever skb_ensure_writable() must expand a cloned skb, which the attacker can influence by sustaining traffic on the proxied connection.\nPR:N - Exploitation requires only that the victim already runs SYNPROXY (normal for protected services); the remote attacker needs no credentials or local privileges on the target system to send the triggering TCP packets.\nUI:N - No victim user action is required beyond normal network operation; exploitation is fully automated via crafted or sustained TCP traffic through the SYNPROXY session.\nS:U - Impact is confined to kernel memory on the affected host running SYNPROXY; this is standard kernel privilege escalation/memory corruption, not a cross-VM or cross-security-boundary escape.\nC:H - The stale tcphdr pointer causes inet_proto_csum_replace4() to write into freed slab memory, a use-after-free class bug that can be leveraged for arbitrary kernel memory read via heap grooming techniques.\nI:H - The out-of-bounds write into freed slab memory via a stale tcphdr pointer is a use-after-free write primitive that can be developed into arbitrary kernel memory writes and local privilege escalation.\nA:H - Writing into freed slab memory can corrupt adjacent kernel objects and cause kernel oops, panic, or crash, and UAF conditions are inherently capable of destabilizing the system even during exploitation attempts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:38:06.995Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c"
},
{
"url": "https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04"
},
{
"url": "https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc"
},
{
"url": "https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7"
},
{
"url": "https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96"
},
{
"url": "https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf"
},
{
"url": "https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e"
},
{
"url": "https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1"
}
],
"title": "netfilter: synproxy: refresh tcphdr after skb_ensure_writable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64007",
"datePublished": "2026-07-19T14:56:23.049Z",
"dateReserved": "2026-07-19T07:54:57.026Z",
"dateUpdated": "2026-10-19T20:28:08.086Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80553 (GCVE-0-2026-80553)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-10-16 19:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio_ccw: Cancel existing workqueues
The initialization of the io_work and crw_work workqueues begs the
question of whether they should be un-initialized. Add the corresponding
cleanup tags in _release_dev to ensure work isn't dispatched after
the private struct is free'd.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e5f84dbaea59b4f712dac428c337528b70e1c533 Version: e5f84dbaea59b4f712dac428c337528b70e1c533 Version: e5f84dbaea59b4f712dac428c337528b70e1c533 Version: e5f84dbaea59b4f712dac428c337528b70e1c533 Version: e5f84dbaea59b4f712dac428c337528b70e1c533 Version: e5f84dbaea59b4f712dac428c337528b70e1c533 Version: e5f84dbaea59b4f712dac428c337528b70e1c533 Version: e5f84dbaea59b4f712dac428c337528b70e1c533 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80553",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:17:19.506995Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:26.626Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/cio/vfio_ccw_ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "87d569cb35a541b31a184faf982540694d4c9a89",
"status": "affected",
"version": "e5f84dbaea59b4f712dac428c337528b70e1c533",
"versionType": "git"
},
{
"lessThan": "7492ca2d0c5d59add01e267be9f5a6eeb8076fd7",
"status": "affected",
"version": "e5f84dbaea59b4f712dac428c337528b70e1c533",
"versionType": "git"
},
{
"lessThan": "b94b28c1f0fae53b2f2d6180ae6442c9a1558f67",
"status": "affected",
"version": "e5f84dbaea59b4f712dac428c337528b70e1c533",
"versionType": "git"
},
{
"lessThan": "e868ea8be0bc88c6982f48ecf3259d98afd884ae",
"status": "affected",
"version": "e5f84dbaea59b4f712dac428c337528b70e1c533",
"versionType": "git"
},
{
"lessThan": "dc47a98abe6714577a25224534dbd356051097a3",
"status": "affected",
"version": "e5f84dbaea59b4f712dac428c337528b70e1c533",
"versionType": "git"
},
{
"lessThan": "b7ae0f7993867d009a4b554fc1d6d451c10580a0",
"status": "affected",
"version": "e5f84dbaea59b4f712dac428c337528b70e1c533",
"versionType": "git"
},
{
"lessThan": "77f5e888d2e607a0b3141fb95091ad6ef1cca9a2",
"status": "affected",
"version": "e5f84dbaea59b4f712dac428c337528b70e1c533",
"versionType": "git"
},
{
"lessThan": "79c60b2c61105368dcc8444eb45847e21734f7c4",
"status": "affected",
"version": "e5f84dbaea59b4f712dac428c337528b70e1c533",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/cio/vfio_ccw_ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio_ccw: Cancel existing workqueues\n\nThe initialization of the io_work and crw_work workqueues begs the\nquestion of whether they should be un-initialized. Add the corresponding\ncleanup tags in _release_dev to ensure work isn\u0027t dispatched after\nthe private struct is free\u0027d."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through local VFIO mediated-device syscalls (read/write/ioctl on /dev/vfio/* and device fds) that start channel I/O or receive CRW events; vfio-ccw has no network, Bluetooth, or physical-bus packet entry point.\nAC:L - This is a close/teardown versus workqueue race where the VFIO client controls both sides: it can submit I/O that queues io_work/crw_work via interrupts or path events, then close or release the device while work is still pending, and retry to win reliably.\nPR:L - Exploitation requires access to an opened vfio-ccw mdev (typical QEMU/libvirt VM operator or delegated /dev/vfio holder on an IBM Z passthrough host), not init-namespace root; mdev creation is admin setup, but triggering the UAF needs only the delegated VFIO fd.\nUI:N - No separate victim action is required; once vfio-ccw passthrough is configured, the attacker issues channel I/O and coordinates device close/release (e.g., hot-unplug or fd teardown) without needing another user to mount media or click anything.\nS:C - On IBM Z/LinuxONE, vfio-ccw exists to pass DASD subchannels into KVM guests; guest-driven channel I/O causes host interrupt/workqueue activity and host-side teardown UAF corrupts hypervisor kernel memory outside the VM security boundary.\nC:H - vfio_ccw_sch_io_todo() and vfio_ccw_crw_todo() dereference freed vfio_ccw_private fields (io_mutex, cp, io_region, crw list, eventfd pointers); per kernel UAF guidance this enables attacker-influenced reuse and arbitrary kernel read primitives.\nI:H - The UAF handlers perform mutex operations, cp_free(), memcpy into io_region, and eventfd_signal() on freed memory, giving heap-sprayable arbitrary write and control-flow hijack potential beyond a simple crash.\nA:H - Use-after-free in deferred I/O/CRW work during device close or release can immediately oops or panic the host kernel from invalid mutex/structure access, and successful exploitation can hang or crash the system even when not leveraged for code execution."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:40:13.853Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/87d569cb35a541b31a184faf982540694d4c9a89"
},
{
"url": "https://git.kernel.org/stable/c/7492ca2d0c5d59add01e267be9f5a6eeb8076fd7"
},
{
"url": "https://git.kernel.org/stable/c/b94b28c1f0fae53b2f2d6180ae6442c9a1558f67"
},
{
"url": "https://git.kernel.org/stable/c/e868ea8be0bc88c6982f48ecf3259d98afd884ae"
},
{
"url": "https://git.kernel.org/stable/c/dc47a98abe6714577a25224534dbd356051097a3"
},
{
"url": "https://git.kernel.org/stable/c/b7ae0f7993867d009a4b554fc1d6d451c10580a0"
},
{
"url": "https://git.kernel.org/stable/c/77f5e888d2e607a0b3141fb95091ad6ef1cca9a2"
},
{
"url": "https://git.kernel.org/stable/c/79c60b2c61105368dcc8444eb45847e21734f7c4"
}
],
"title": "s390/vfio_ccw: Cancel existing workqueues",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80553",
"datePublished": "2026-08-26T14:37:21.774Z",
"dateReserved": "2026-08-26T14:34:25.766Z",
"dateUpdated": "2026-10-16T19:26:26.626Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46174 (GCVE-0-2026-46174)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-10-19 19:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache
Make sure resources are not improperly shared in the op cache and
cause instruction corruption this way.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9 Version: f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9 Version: f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9 Version: f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9 Version: f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9 Version: f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9 Version: f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9 Version: f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9 Version: 5abd1583e06b3963e5c9d915760367de86808b78 Version: 4ba461d426490b6ed7e8298c4d3b7a13aa5d2686 Version: 5a63725cd18fcee2af6ec46ccb856b64ad3077b4 Version: 3.16.58 ≤ Version: 4.4.144 ≤ Version: 4.9.102 ≤ |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:21:05.553Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46174",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:20:43.490528Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:36:53.596Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/include/asm/msr-index.h",
"arch/x86/kernel/cpu/amd.c",
"tools/arch/x86/include/asm/msr-index.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1e23b30a80b14e5764657401ee2cca030525ae8e",
"status": "affected",
"version": "f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9",
"versionType": "git"
},
{
"lessThan": "f5bc3aef7df46eaaf423d7413ab8833f704ae576",
"status": "affected",
"version": "f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9",
"versionType": "git"
},
{
"lessThan": "251497955f2314cd39d43191e81c6151dead4c7b",
"status": "affected",
"version": "f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9",
"versionType": "git"
},
{
"lessThan": "ff6fc65b3bf73acc5ee71919154d830ad5431362",
"status": "affected",
"version": "f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9",
"versionType": "git"
},
{
"lessThan": "9109489cc8c34e50d15575a3d1ff82af586bc1aa",
"status": "affected",
"version": "f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9",
"versionType": "git"
},
{
"lessThan": "28f5ed477eef166d678d6966762cbc1de9b4f436",
"status": "affected",
"version": "f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9",
"versionType": "git"
},
{
"lessThan": "1cd85a19748b2407830376a5cbae5c0f126016e5",
"status": "affected",
"version": "f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9",
"versionType": "git"
},
{
"lessThan": "c21b90f77687075115d989e53a8ec5e2bb427ab1",
"status": "affected",
"version": "f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9",
"versionType": "git"
},
{
"status": "affected",
"version": "5abd1583e06b3963e5c9d915760367de86808b78",
"versionType": "git"
},
{
"status": "affected",
"version": "4ba461d426490b6ed7e8298c4d3b7a13aa5d2686",
"versionType": "git"
},
{
"status": "affected",
"version": "5a63725cd18fcee2af6ec46ccb856b64ad3077b4",
"versionType": "git"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.58",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.144",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.102",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/include/asm/msr-index.h",
"arch/x86/kernel/cpu/amd.c",
"tools/arch/x86/include/asm/msr-index.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.256",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.207",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.173",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.139",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.256",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.207",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.173",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.139",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.144",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.102",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU/AMD: Prevent improper isolation of shared resources in Zen2\u0027s op cache\n\nMake sure resources are not improperly shared in the op cache and\ncause instruction corruption this way."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is in the CPU\u0027s op cache and requires executing instructions on the affected core to drive improper resource sharing; it is not reachable over a network. Triggering it needs local code execution on the machine.\nAC:L - An attacker who can co-schedule code on SMT siblings of an affected Zen2 core controls both sides of the shared op-cache contention and can reliably drive the improper-isolation condition. Following the higher-severity rule, this is Low.\nPR:L - Triggering the op-cache resource sharing only requires the ability to run code (an unprivileged local user or a guest VM tenant); no root or admin capability is needed. It does, however, require at least some local execution access, so not None.\nUI:N - The attacker\u0027s own executing code populates and contends for the op cache; no victim action is required.\nS:C - The bug is an isolation failure of a microarchitectural resource shared across SMT threads, so instruction corruption can cross from the attacker\u0027s context into a different security authority (another VM/tenant or the host kernel), impacting resources beyond the attacking component\u0027s scope.\nC:H - Improper isolation of a shared op-cache resource is an information-disclosure vector across contexts, and the resulting instruction corruption can be leveraged to read memory belonging to another security domain.\nI:H - The defining impact is \"instruction corruption\" \u2014 the CPU executes corrupted/wrong instructions in a victim context, which is a direct, severe integrity violation enabling control-flow and data corruption across the isolation boundary.\nA:H - Instruction corruption causes incorrect execution, crashes, and hangs in the affected (potentially cross-context) code, resulting in high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:12.168Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1e23b30a80b14e5764657401ee2cca030525ae8e"
},
{
"url": "https://git.kernel.org/stable/c/f5bc3aef7df46eaaf423d7413ab8833f704ae576"
},
{
"url": "https://git.kernel.org/stable/c/251497955f2314cd39d43191e81c6151dead4c7b"
},
{
"url": "https://git.kernel.org/stable/c/ff6fc65b3bf73acc5ee71919154d830ad5431362"
},
{
"url": "https://git.kernel.org/stable/c/9109489cc8c34e50d15575a3d1ff82af586bc1aa"
},
{
"url": "https://git.kernel.org/stable/c/28f5ed477eef166d678d6966762cbc1de9b4f436"
},
{
"url": "https://git.kernel.org/stable/c/1cd85a19748b2407830376a5cbae5c0f126016e5"
},
{
"url": "https://git.kernel.org/stable/c/c21b90f77687075115d989e53a8ec5e2bb427ab1"
}
],
"title": "x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2\u0027s op cache",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46174",
"datePublished": "2026-05-28T09:36:28.703Z",
"dateReserved": "2026-05-13T15:03:33.103Z",
"dateUpdated": "2026-10-19T19:36:53.596Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46056 (GCVE-0-2026-46056)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-10-19 19:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
hci_conn lookup and field access must be covered by hdev lock in
hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise
the connection can be freed concurrently.
Extend the hci_dev_lock critical section to cover all conn usage in both
handlers.
Keep the existing keypress notification behavior unchanged by routing
the early exits through a common unlock path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 92a25256f142d55e25f9959441cea6ddeabae57e Version: 92a25256f142d55e25f9959441cea6ddeabae57e Version: 92a25256f142d55e25f9959441cea6ddeabae57e Version: 92a25256f142d55e25f9959441cea6ddeabae57e Version: 92a25256f142d55e25f9959441cea6ddeabae57e Version: 92a25256f142d55e25f9959441cea6ddeabae57e Version: 92a25256f142d55e25f9959441cea6ddeabae57e Version: 92a25256f142d55e25f9959441cea6ddeabae57e |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:20:17.000Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46056",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:19:20.098587Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:26:42.490Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ea18732d2614557e59f4c0d8cdbe6611aeab33b7",
"status": "affected",
"version": "92a25256f142d55e25f9959441cea6ddeabae57e",
"versionType": "git"
},
{
"lessThan": "d28311539ac9f65e29308ea219ecaa48aa5e76e5",
"status": "affected",
"version": "92a25256f142d55e25f9959441cea6ddeabae57e",
"versionType": "git"
},
{
"lessThan": "b6ae482f88654db407c8c17619d4b62959b903ef",
"status": "affected",
"version": "92a25256f142d55e25f9959441cea6ddeabae57e",
"versionType": "git"
},
{
"lessThan": "204028af77a265e31ceb4ba7f643349a3cca72b2",
"status": "affected",
"version": "92a25256f142d55e25f9959441cea6ddeabae57e",
"versionType": "git"
},
{
"lessThan": "01a6431766c35dfedb86e0cb5d3fc80c6d604a47",
"status": "affected",
"version": "92a25256f142d55e25f9959441cea6ddeabae57e",
"versionType": "git"
},
{
"lessThan": "e08d75753db17aa943d7622f09d9c217b5bfd3b8",
"status": "affected",
"version": "92a25256f142d55e25f9959441cea6ddeabae57e",
"versionType": "git"
},
{
"lessThan": "8c6443bb9257b780986fb67ec08565bf48ecb8d7",
"status": "affected",
"version": "92a25256f142d55e25f9959441cea6ddeabae57e",
"versionType": "git"
},
{
"lessThan": "85fa3512048793076eef658f66489112dcc91993",
"status": "affected",
"version": "92a25256f142d55e25f9959441cea6ddeabae57e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: fix potential UAF in SSP passkey handlers\n\nhci_conn lookup and field access must be covered by hdev lock in\nhci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise\nthe connection can be freed concurrently.\n\nExtend the hci_dev_lock critical section to cover all conn usage in both\nhandlers.\n\nKeep the existing keypress notification behavior unchanged by routing\nthe early exits through a common unlock path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable handlers process HCI Secure Simple Pairing events (User Passkey Notify / Keypress Notify) driven by a remote Bluetooth peer during SSP pairing, so the attacker must be within Bluetooth radio range (adjacent), matching kernel guidance that Bluetooth = Adjacent.\nAC:L - This is a use-after-free where a remote peer drives the passkey/keypress events while connection teardown frees the conn from a concurrent context; the attacker influences both sides of the race and can retry, and UAF bugs are scored AC:L unless the race is uncontrollable.\nPR:N - The code path is reached by a remote Bluetooth device participating in the SSP pairing handshake, requiring no credentials or privileges on the target system.\nUI:N - The handlers execute automatically when the controller forwards the SSP passkey/keypress HCI events during the pairing protocol exchange; no local user action is required to reach the vulnerable code.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The use-after-free reads fields (dst, type, dst_type, passkey) from a freed and potentially reallocated hci_conn object, which can disclose attacker-controlled or sensitive kernel heap contents.\nI:H - The handlers write to the freed object (passkey_notify and passkey_entered fields), giving a UAF write into reallocated heap memory that can be leveraged for heap grooming and control-flow corruption.\nA:H - A use-after-free on the hci_conn structure readily causes kernel oops/panic, yielding high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:24.462Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ea18732d2614557e59f4c0d8cdbe6611aeab33b7"
},
{
"url": "https://git.kernel.org/stable/c/d28311539ac9f65e29308ea219ecaa48aa5e76e5"
},
{
"url": "https://git.kernel.org/stable/c/b6ae482f88654db407c8c17619d4b62959b903ef"
},
{
"url": "https://git.kernel.org/stable/c/204028af77a265e31ceb4ba7f643349a3cca72b2"
},
{
"url": "https://git.kernel.org/stable/c/01a6431766c35dfedb86e0cb5d3fc80c6d604a47"
},
{
"url": "https://git.kernel.org/stable/c/e08d75753db17aa943d7622f09d9c217b5bfd3b8"
},
{
"url": "https://git.kernel.org/stable/c/8c6443bb9257b780986fb67ec08565bf48ecb8d7"
},
{
"url": "https://git.kernel.org/stable/c/85fa3512048793076eef658f66489112dcc91993"
}
],
"title": "Bluetooth: hci_event: fix potential UAF in SSP passkey handlers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46056",
"datePublished": "2026-05-27T12:57:15.150Z",
"dateReserved": "2026-05-13T15:03:33.094Z",
"dateUpdated": "2026-10-19T19:26:42.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53270 (GCVE-0-2026-53270)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-10-19 19:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvs: clear the svc scheduler ptr early on edit
ip_vs_edit_service() while unbinding the old scheduler clears
the svc->scheduler ptr after the scheduler module initiates
RCU callbacks. This can cause packets to use the old
scheduler at the time when svc->sched_data is already freed
after RCU grace period.
Fix it by clearing the ptr early in ip_vs_unbind_scheduler(),
before the done_service method schedules any RCU callbacks.
Also, if the new scheduler fails to initialize when replacing
the old scheduler, try to restore the old scheduler while still
returning the error code.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 05f00505a89acd21f5d0d20f5797dfbc4cf85243 Version: 05f00505a89acd21f5d0d20f5797dfbc4cf85243 Version: 05f00505a89acd21f5d0d20f5797dfbc4cf85243 Version: 05f00505a89acd21f5d0d20f5797dfbc4cf85243 Version: 05f00505a89acd21f5d0d20f5797dfbc4cf85243 Version: 05f00505a89acd21f5d0d20f5797dfbc4cf85243 Version: 05f00505a89acd21f5d0d20f5797dfbc4cf85243 Version: 05f00505a89acd21f5d0d20f5797dfbc4cf85243 Version: c803fddd2a95a70873c68dbff42d4c59fd2e674e Version: 4ec8fb23158797affae7993c15beba080488482f Version: 3.18.23 ≤ Version: 4.1.11 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53270",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:28:13.169684Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:57:32.999Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/ip_vs.h",
"net/netfilter/ipvs/ip_vs_ctl.c",
"net/netfilter/ipvs/ip_vs_sched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d10730a1f2caf08088e0db1b19b242f3e6fa5f06",
"status": "affected",
"version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
"versionType": "git"
},
{
"lessThan": "e4feec3174036ba772006be74beee0efa09a9eb8",
"status": "affected",
"version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
"versionType": "git"
},
{
"lessThan": "7d4f5004511757e3984901ffb412fcf858d80ed5",
"status": "affected",
"version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
"versionType": "git"
},
{
"lessThan": "c6376b9b1b4d2bad638256b1b3588e073344ae69",
"status": "affected",
"version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
"versionType": "git"
},
{
"lessThan": "14e4689c113b4c06af1069364ade24fdd7055f33",
"status": "affected",
"version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
"versionType": "git"
},
{
"lessThan": "25918720ba97f974a4f8d433b5a0132c5b43f6f3",
"status": "affected",
"version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
"versionType": "git"
},
{
"lessThan": "19a9493faa4bf3c7bd0a386f30b60b1bb4a3da03",
"status": "affected",
"version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
"versionType": "git"
},
{
"lessThan": "193989cc6d80dd8e0460fb3992e69fa03bf0ff9b",
"status": "affected",
"version": "05f00505a89acd21f5d0d20f5797dfbc4cf85243",
"versionType": "git"
},
{
"status": "affected",
"version": "c803fddd2a95a70873c68dbff42d4c59fd2e674e",
"versionType": "git"
},
{
"status": "affected",
"version": "4ec8fb23158797affae7993c15beba080488482f",
"versionType": "git"
},
{
"lessThan": "3.19",
"status": "affected",
"version": "3.18.23",
"versionType": "semver"
},
{
"lessThan": "4.2",
"status": "affected",
"version": "4.1.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/ip_vs.h",
"net/netfilter/ipvs/ip_vs_ctl.c",
"net/netfilter/ipvs/ip_vs_sched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.1.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear the svc scheduler ptr early on edit\n\nip_vs_edit_service() while unbinding the old scheduler clears\nthe svc-\u003escheduler ptr after the scheduler module initiates\nRCU callbacks. This can cause packets to use the old\nscheduler at the time when svc-\u003esched_data is already freed\nafter RCU grace period.\n\nFix it by clearing the ptr early in ip_vs_unbind_scheduler(),\nbefore the done_service method schedules any RCU callbacks.\n\nAlso, if the new scheduler fails to initialize when replacing\nthe old scheduler, try to restore the old scheduler while still\nreturning the error code."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable transition is reached through local IPVS service-edit control paths such as `setsockopt(IP_VS_SO_SET_EDIT)` or IPVS generic netlink; packets exercise the stale scheduler afterward, but the attacker must initiate the local service edit.\nAC:L - The attacker can control both sides of the condition by changing the scheduler and generating new TCP/UDP/SCTP traffic to the service, so this is not dependent on an uncontrollable race.\nPR:L - The legacy setsockopt path checks `CAP_NET_ADMIN` in the socket network namespace, which is reachable by an unprivileged local user via user and network namespaces in plausible deployments.\nUI:N - No victim interaction is needed once the attacker has local access and namespace privileges; the attacker can create/edit the IPVS service and send triggering traffic.\nS:U - The impact is kernel memory corruption within the same host security authority, not a VM, IOMMU, or separate security-scope escape.\nC:H - This is an RCU use-after-free of scheduler-private `svc-\u003esched_data`, and freed scheduler state can be reused and dereferenced by packet scheduling, making high confidentiality impact defensible.\nI:H - Several affected schedulers write through the stale `sched_data` pointer, so the UAF can plausibly become arbitrary kernel memory corruption or control-flow compromise.\nA:H - At minimum the stale scheduler pointer can dereference freed scheduler state during packet processing and crash or panic the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:46.621Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d10730a1f2caf08088e0db1b19b242f3e6fa5f06"
},
{
"url": "https://git.kernel.org/stable/c/e4feec3174036ba772006be74beee0efa09a9eb8"
},
{
"url": "https://git.kernel.org/stable/c/7d4f5004511757e3984901ffb412fcf858d80ed5"
},
{
"url": "https://git.kernel.org/stable/c/c6376b9b1b4d2bad638256b1b3588e073344ae69"
},
{
"url": "https://git.kernel.org/stable/c/14e4689c113b4c06af1069364ade24fdd7055f33"
},
{
"url": "https://git.kernel.org/stable/c/25918720ba97f974a4f8d433b5a0132c5b43f6f3"
},
{
"url": "https://git.kernel.org/stable/c/19a9493faa4bf3c7bd0a386f30b60b1bb4a3da03"
},
{
"url": "https://git.kernel.org/stable/c/193989cc6d80dd8e0460fb3992e69fa03bf0ff9b"
}
],
"title": "ipvs: clear the svc scheduler ptr early on edit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53270",
"datePublished": "2026-06-25T08:39:55.830Z",
"dateReserved": "2026-06-09T07:44:35.395Z",
"dateUpdated": "2026-10-19T19:57:32.999Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98974 (GCVE-0-2026-98974)
Vulnerability from cvelistv5
Published
2026-10-23 12:19
Modified
2026-10-24 14:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix exchange-range-to-eof file size exchange
Norbert Szetei posted a patch containing an incomplete description of a
bug in XFS_IOC_EXCHANGE_RANGE's TO_EOF flag. The bug tricks
exchange-range into modifying a file so that it has shared blocks
starting beyond EOF, which is never allowed because files never have
written data beyond EOF, and you can only share written data blocks.
This is key to all the incorrect behavior that follows.
Eventually I got from Norbert a description of what's going wrong:
> Fair. Here it is with physical block numbers, 4k blocks. peer is the file
> that gets rewritten and file1 is the one that ends up with the flag
> cleared.
>
> Start, nothing shared:
>
> peer size 4096 -> [100]
> file1 size 12288 -> [200] [201] [202]
> donor1 size 4096 -> [300]
> donor2 size 4096 -> [400]
>
> 1. FICLONERANGE peer's block into file1's middle slot:
>
> peer size 4096 -> [100]
> file1 size 12288 -> [200] [100] [202] reflink flag set
> ^^^^^ both files own block 100
>
> 2. XFS_IOC_EXCHANGE_RANGE file1 against donor1, file1_offset 0,
> file2_offset 8192, length 0, TO_EOF. One block is exchanged, and the sizes
> are exchanged with it:
>
> file1 size 4096 -> [200] [100] [300] reflink flag set
> ^^^^^^^^^^^ still owned, now past the size
> donor1 size 12288 -> [202]
>
> file1 says it is one block long while it still owns three. Nothing was
> unmapped. file2_offset is block 2, so this exchange cannot clear a flag.
>
> 3. XFS_IOC_EXCHANGE_RANGE file1 against donor2, both offsets 0, length 4096.
> By i_disk_size this is two one-block files exchanging everything, so
> xmi_can_exchange_reflink_flags() agrees and the flag is cleared:
>
> file1 size 4096 -> [400] [100] [300] reflink flag CLEARED
> donor2 size 4096 -> [200]
>
> Block 100 is still shared with peer.
>
> 4. pwrite(file1, 4096, 4096), which is file1's second slot, block 100.
> xfs_is_cow_inode(file1) is false, so no CoW:
>
> peer size 4096 -> [100] same block, new contents
>
> Block 100 is the only one that matters here. PoC below, it reads a file
> called peer in the current directory. The filesystem needs reflink and
> exchange-range, which mkfs.xfs 7.x turns on by default.
So yes, TO_EOF is screwing up the file size even if it's actually
exchanging the data block correctly. The following is the intended
behavior of XFS_EXCHANGE_RANGE_TO_EOF, as described by its manpage:
"Ignore the length parameter. All bytes in file1_fd from file1_offset
to EOF are moved to file2_fd, and file2's size is set to
(file2_offset+(file1_length-file1_offset)). Meanwhile, all bytes in
file2 from file2_offset to EOF are moved to file1 and file1's size is
set to (file1_offset+(file2_length-file2_offset))."
In other words, if we only exchange a portion of the file data, then we
should only exchange the portion of the file size that relates to the
exchanged data. Unfortunately, the code swaps the ondisk file size and
the incore file sizes, which is incorrect if the caller passes in a
nonzero offset.
Having confused the file sizes, the PoC uses a second exchange-range
call on what looks like a non-reflinked single-block file. Because the
file size is set incorrectly, exchange-range thinks it's exchanging the
full contents of two files and clears the reflink flag on the broken
file. That enables an extending write of the broken file to rewrite the
shared block that's just past EOF. This has become known colloquially
as refluxfs.
Once the file sizes are set correctly, the second exchange-range no
longer thinks that it's doing a full-contents swap, so it won't clear
the reflink flag on either of its file arguments.
Norbert followed up to an earlier version of this patch with a second
complaint about us not handling the i_disk_size state correctly:
> The offsets are bounded against the incore i_size but subtracted from
>
---truncated---
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_exchmaps.c",
"fs/xfs/xfs_exchrange.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b361d32b884f8ddcb9bad5d99b69eece648f8e43",
"status": "affected",
"version": "966ceafc7a437105ecfe1cadb3747b2965a260ca",
"versionType": "git"
},
{
"lessThan": "cf32eb20dfacfd2e92ce86ba1fece9ae5f98a7d8",
"status": "affected",
"version": "966ceafc7a437105ecfe1cadb3747b2965a260ca",
"versionType": "git"
},
{
"lessThan": "952b5c99a840c2bff1f6645fd5e06e1db6ec2623",
"status": "affected",
"version": "966ceafc7a437105ecfe1cadb3747b2965a260ca",
"versionType": "git"
},
{
"lessThan": "7dfb218c829c1acb626e0fe92c5fddb9a26a03e9",
"status": "affected",
"version": "966ceafc7a437105ecfe1cadb3747b2965a260ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_exchmaps.c",
"fs/xfs/xfs_exchrange.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix exchange-range-to-eof file size exchange\n\nNorbert Szetei posted a patch containing an incomplete description of a\nbug in XFS_IOC_EXCHANGE_RANGE\u0027s TO_EOF flag. The bug tricks\nexchange-range into modifying a file so that it has shared blocks\nstarting beyond EOF, which is never allowed because files never have\nwritten data beyond EOF, and you can only share written data blocks.\nThis is key to all the incorrect behavior that follows.\n\nEventually I got from Norbert a description of what\u0027s going wrong:\n\n\u003e Fair. Here it is with physical block numbers, 4k blocks. peer is the file\n\u003e that gets rewritten and file1 is the one that ends up with the flag\n\u003e cleared.\n\u003e\n\u003e Start, nothing shared:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100]\n\u003e\tfile1 size 12288 -\u003e [200] [201] [202]\n\u003e\tdonor1 size 4096 -\u003e [300]\n\u003e\tdonor2 size 4096 -\u003e [400]\n\u003e\n\u003e 1. FICLONERANGE peer\u0027s block into file1\u0027s middle slot:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100]\n\u003e\tfile1 size 12288 -\u003e [200] [100] [202] reflink flag set\n\u003e ^^^^^ both files own block 100\n\u003e\n\u003e 2. XFS_IOC_EXCHANGE_RANGE file1 against donor1, file1_offset 0,\n\u003e file2_offset 8192, length 0, TO_EOF. One block is exchanged, and the sizes\n\u003e are exchanged with it:\n\u003e\n\u003e\tfile1 size 4096 -\u003e [200] [100] [300] reflink flag set\n\u003e ^^^^^^^^^^^ still owned, now past the size\n\u003e\tdonor1 size 12288 -\u003e [202]\n\u003e\n\u003e file1 says it is one block long while it still owns three. Nothing was\n\u003e unmapped. file2_offset is block 2, so this exchange cannot clear a flag.\n\u003e\n\u003e 3. XFS_IOC_EXCHANGE_RANGE file1 against donor2, both offsets 0, length 4096.\n\u003e By i_disk_size this is two one-block files exchanging everything, so\n\u003e xmi_can_exchange_reflink_flags() agrees and the flag is cleared:\n\u003e\n\u003e\tfile1 size 4096 -\u003e [400] [100] [300] reflink flag CLEARED\n\u003e\tdonor2 size 4096 -\u003e [200]\n\u003e\n\u003e Block 100 is still shared with peer.\n\u003e\n\u003e 4. pwrite(file1, 4096, 4096), which is file1\u0027s second slot, block 100.\n\u003e xfs_is_cow_inode(file1) is false, so no CoW:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100] same block, new contents\n\u003e\n\u003e Block 100 is the only one that matters here. PoC below, it reads a file\n\u003e called peer in the current directory. The filesystem needs reflink and\n\u003e exchange-range, which mkfs.xfs 7.x turns on by default.\n\nSo yes, TO_EOF is screwing up the file size even if it\u0027s actually\nexchanging the data block correctly. The following is the intended\nbehavior of XFS_EXCHANGE_RANGE_TO_EOF, as described by its manpage:\n\n\"Ignore the length parameter. All bytes in file1_fd from file1_offset\n to EOF are moved to file2_fd, and file2\u0027s size is set to\n (file2_offset+(file1_length-file1_offset)). Meanwhile, all bytes in\n file2 from file2_offset to EOF are moved to file1 and file1\u0027s size is\n set to (file1_offset+(file2_length-file2_offset)).\"\n\nIn other words, if we only exchange a portion of the file data, then we\nshould only exchange the portion of the file size that relates to the\nexchanged data. Unfortunately, the code swaps the ondisk file size and\nthe incore file sizes, which is incorrect if the caller passes in a\nnonzero offset.\n\nHaving confused the file sizes, the PoC uses a second exchange-range\ncall on what looks like a non-reflinked single-block file. Because the\nfile size is set incorrectly, exchange-range thinks it\u0027s exchanging the\nfull contents of two files and clears the reflink flag on the broken\nfile. That enables an extending write of the broken file to rewrite the\nshared block that\u0027s just past EOF. This has become known colloquially\nas refluxfs.\n\nOnce the file sizes are set correctly, the second exchange-range no\nlonger thinks that it\u0027s doing a full-contents swap, so it won\u0027t clear\nthe reflink flag on either of its file arguments.\n\nNorbert followed up to an earlier version of this patch with a second\ncomplaint about us not handling the i_disk_size state correctly:\n\n\u003e The offsets are bounded against the incore i_size but subtracted from\n\u003e\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker-controlled offsets and XFS_EXCHANGE_RANGE_TO_EOF flag enter through ioctl(2), then xfs_file_ioctl -\u003e xfs_ioc_exchange_range -\u003e xfs_exchange_range -\u003e xfs_exchrange_mappings/xfs_exchmaps_init_intent, the two patched functions; no network data reaches this path.\nAC:L - On XFS with reflink and exchange-range enabled, one process can deterministically clone a readable peer block, issue the TO_EOF and full-range exchanges, then pwrite; every transition is attacker-controlled and no race is required.\nPR:L - xfs_exchange_range requires read/write access to the exchanged files, which can be attacker-owned. The protected peer is only the FICLONERANGE source, and vfs_clone_file_range requires MAY_READ on it without any capability check.\nUI:N - The attacker alone invokes FICLONERANGE, two XFS_IOC_EXCHANGE_RANGE operations, and pwrite against an already-mounted XFS filesystem; no victim must open a file or mount attacker-supplied media.\nS:U - The incorrect size exchange in xfs_exchmaps_init_intent and resulting CoW bypass affect files and privileges within the same host kernel security authority; no VM, IOMMU, or other scope boundary is crossed.\nC:H - After xfs_exchmaps_clear_reflink removes XFS_DIFLAG2_REFLINK, xfs_is_cow_inode returns false and pwrite can alter a still-shared block in a readable root-owned setuid executable; its unchanged privileged metadata permits root execution and access to all host data.\nI:H - The non-CoW pwrite supplies controlled full-block contents to a physical extent still owned by a root-owned readable file, allowing arbitrary modification of protected files on the same XFS volume despite DAC.\nA:H - The same controlled shared-block overwrite can corrupt the headers or code of essential readable system binaries, libraries, or boot files on XFS, causing complete service or system failure."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:09:44.115Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b361d32b884f8ddcb9bad5d99b69eece648f8e43"
},
{
"url": "https://git.kernel.org/stable/c/cf32eb20dfacfd2e92ce86ba1fece9ae5f98a7d8"
},
{
"url": "https://git.kernel.org/stable/c/952b5c99a840c2bff1f6645fd5e06e1db6ec2623"
},
{
"url": "https://git.kernel.org/stable/c/7dfb218c829c1acb626e0fe92c5fddb9a26a03e9"
}
],
"title": "xfs: fix exchange-range-to-eof file size exchange",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98974",
"datePublished": "2026-10-23T12:19:47.424Z",
"dateReserved": "2026-09-25T10:25:14.383Z",
"dateUpdated": "2026-10-24T14:09:44.115Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63831 (GCVE-0-2026-63831)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-10-19 20:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mac802154: llsec: add skb_cow_data() before in-place crypto
llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(),
llsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform
in-place cryptographic transformations on skb data. They build a
scatterlist with sg_init_one() pointing into the skb's linear data area
and then pass the same scatterlist as both src and dst to the crypto API
(e.g. crypto_skcipher_encrypt/decrypt, crypto_aead_encrypt/decrypt).
On the RX path, __ieee802154_rx_handle_packet() clones the received skb
before handing it to each subscriber via ieee802154_subif_frame(). The
cloned skb shares the same underlying data buffer via reference
counting. When llsec_do_decrypt() subsequently modifies this shared
buffer in place, it corrupts data that other clones -- potentially
belonging to other sockets or subsystems -- still reference.
On the TX path, similar data sharing can occur when an skb's head has
been cloned (skb_cloned() returns true).
The fix is to call skb_cow_data() before performing any in-place crypto
operation. skb_cow_data() ensures that the skb's data area is not
shared: if the skb head is cloned or the data spans multiple fragments,
it copies the data into a private buffer that can be safely modified in
place. This is the same pattern used by:
- ESP (net/ipv4/esp4.c, net/ipv6/esp6.c)
- MACsec (drivers/net/macsec.c)
- WireGuard (drivers/net/wireguard/receive.c)
- TIPC (net/tipc/crypto.c)
Without this guard, in-place crypto on shared skb data leads to:
- Silent data corruption of other skb clones
- Use-after-free when the crypto API scatterwalk writes through a
page that has already been freed by another clone's kfree_skb()
- Kernel crashes under concurrent 802.15.4 traffic with security
enabled (KASAN/KMSAN reports slab-use-after-free)
Found by 0sec (https://0sec.ai) using automated source analysis.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 03556e4d0dbbbf4af9df76f4a3839c86f6afb015 Version: 03556e4d0dbbbf4af9df76f4a3839c86f6afb015 Version: 03556e4d0dbbbf4af9df76f4a3839c86f6afb015 Version: 03556e4d0dbbbf4af9df76f4a3839c86f6afb015 Version: 03556e4d0dbbbf4af9df76f4a3839c86f6afb015 Version: 03556e4d0dbbbf4af9df76f4a3839c86f6afb015 Version: 03556e4d0dbbbf4af9df76f4a3839c86f6afb015 Version: 03556e4d0dbbbf4af9df76f4a3839c86f6afb015 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63831",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:31:21.214861Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:07:49.327Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac802154/llsec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3a2b378b3a9ca75d3518d879148d2ad25b5714a9",
"status": "affected",
"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
"versionType": "git"
},
{
"lessThan": "7a831bcd0486788283ef35e396d4282ee01bb0d5",
"status": "affected",
"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
"versionType": "git"
},
{
"lessThan": "ff976ef7c39199ebff33c18034636595016db9f0",
"status": "affected",
"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
"versionType": "git"
},
{
"lessThan": "e28e7fd34c449028325322a3f5127b92594b7396",
"status": "affected",
"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
"versionType": "git"
},
{
"lessThan": "993fd674fe85d114e6a8d3963033d4fbbc2170a8",
"status": "affected",
"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
"versionType": "git"
},
{
"lessThan": "bd968bdd568beacfdf98ec537a87527e85f1d0cf",
"status": "affected",
"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
"versionType": "git"
},
{
"lessThan": "86d531337ea1ba02d9f2bc830d07c683d9bfaade",
"status": "affected",
"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
"versionType": "git"
},
{
"lessThan": "84a04eb5b210643bd67aab81ff805d32f62aa865",
"status": "affected",
"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac802154/llsec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: llsec: add skb_cow_data() before in-place crypto\n\nllsec_do_encrypt_unauth(), llsec_do_encrypt_auth(),\nllsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform\nin-place cryptographic transformations on skb data. They build a\nscatterlist with sg_init_one() pointing into the skb\u0027s linear data area\nand then pass the same scatterlist as both src and dst to the crypto API\n(e.g. crypto_skcipher_encrypt/decrypt, crypto_aead_encrypt/decrypt).\n\nOn the RX path, __ieee802154_rx_handle_packet() clones the received skb\nbefore handing it to each subscriber via ieee802154_subif_frame(). The\ncloned skb shares the same underlying data buffer via reference\ncounting. When llsec_do_decrypt() subsequently modifies this shared\nbuffer in place, it corrupts data that other clones -- potentially\nbelonging to other sockets or subsystems -- still reference.\n\nOn the TX path, similar data sharing can occur when an skb\u0027s head has\nbeen cloned (skb_cloned() returns true).\n\nThe fix is to call skb_cow_data() before performing any in-place crypto\noperation. skb_cow_data() ensures that the skb\u0027s data area is not\nshared: if the skb head is cloned or the data spans multiple fragments,\nit copies the data into a private buffer that can be safely modified in\nplace. This is the same pattern used by:\n\n - ESP (net/ipv4/esp4.c, net/ipv6/esp6.c)\n - MACsec (drivers/net/macsec.c)\n - WireGuard (drivers/net/wireguard/receive.c)\n - TIPC (net/tipc/crypto.c)\n\nWithout this guard, in-place crypto on shared skb data leads to:\n - Silent data corruption of other skb clones\n - Use-after-free when the crypto API scatterwalk writes through a\n page that has already been freed by another clone\u0027s kfree_skb()\n - Kernel crashes under concurrent 802.15.4 traffic with security\n enabled (KASAN/KMSAN reports slab-use-after-free)\n\nFound by 0sec (https://0sec.ai) using automated source analysis."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is reached when the kernel processes incoming IEEE 802.15.4 frames from a radio driver (ieee802154_rx \u2192 llsec_do_decrypt), which requires an attacker within WPAN radio range, analogous to Bluetooth/WiFi adjacent-segment attacks.\nAC:L - An attacker can reliably trigger the flaw by transmitting valid LLSEC-protected 802.15.4 frames (including broadcast frames fanning out to multiple virtual interfaces) and controlling traffic timing; the skb_clone sharing is deterministic on the RX path.\nPR:N - Exploitation requires no local privileges on the victim\u2014only the ability to send 802.15.4 radio frames as a PAN participant with valid LLSEC credentials, which is a network-position requirement rather than elevated kernel access.\nUI:N - No end-user action is needed at exploitation time; triggering the bug only requires the target to already be running mac802154 with LLSEC enabled and receiving attacker-crafted wireless frames.\nS:U - Impact is confined to kernel memory/subsystems on the affected host (UAF, data corruption, crash); it does not inherently cross a VM, container, or IOMMU security boundary.\nC:H - The commit and fix description confirm slab use-after-free from in-place crypto scatterwalk writes through skb data pages freed by sibling clones, enabling arbitrary kernel memory reads.\nI:H - Writing through freed/shared skb pages during in-place decrypt/encrypt corrupts kernel heap contents and provides a standard exploitable memory-corruption primitive for arbitrary modification or code execution.\nA:H - Concurrent LLSEC-enabled 802.15.4 traffic can cause kernel oops/panic, and KASAN/KMSAN reports confirm slab-use-after-free crashes under the vulnerable code path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:51:40.171Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3a2b378b3a9ca75d3518d879148d2ad25b5714a9"
},
{
"url": "https://git.kernel.org/stable/c/7a831bcd0486788283ef35e396d4282ee01bb0d5"
},
{
"url": "https://git.kernel.org/stable/c/ff976ef7c39199ebff33c18034636595016db9f0"
},
{
"url": "https://git.kernel.org/stable/c/e28e7fd34c449028325322a3f5127b92594b7396"
},
{
"url": "https://git.kernel.org/stable/c/993fd674fe85d114e6a8d3963033d4fbbc2170a8"
},
{
"url": "https://git.kernel.org/stable/c/bd968bdd568beacfdf98ec537a87527e85f1d0cf"
},
{
"url": "https://git.kernel.org/stable/c/86d531337ea1ba02d9f2bc830d07c683d9bfaade"
},
{
"url": "https://git.kernel.org/stable/c/84a04eb5b210643bd67aab81ff805d32f62aa865"
}
],
"title": "mac802154: llsec: add skb_cow_data() before in-place crypto",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63831",
"datePublished": "2026-07-19T12:02:24.320Z",
"dateReserved": "2026-07-19T07:54:57.015Z",
"dateUpdated": "2026-10-19T20:07:49.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63974 (GCVE-0-2026-63974)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-10-30 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
Since hci_dev_close_sync() can now be called during the reset path, we
should also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts
while the hdev workqueue is being drained.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 877afadad2dce8aae1f2aad8ce47e072d4f6165e Version: 877afadad2dce8aae1f2aad8ce47e072d4f6165e Version: 877afadad2dce8aae1f2aad8ce47e072d4f6165e Version: 877afadad2dce8aae1f2aad8ce47e072d4f6165e Version: 877afadad2dce8aae1f2aad8ce47e072d4f6165e Version: 877afadad2dce8aae1f2aad8ce47e072d4f6165e Version: 4bf367fa1fefabdf14938d0ac9ed60020389112e Version: 3b382555706558f5c0587862b6dc03e96a252bba Version: 5.18.18 ≤ Version: 5.19.2 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63974",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:34:21.021938Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:59.582Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ccf07dfb9d7d1e2c7a1eeb782f90d9b614ebba9c",
"status": "affected",
"version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e",
"versionType": "git"
},
{
"lessThan": "7b81c1378b79c3143ca3fdb3d18ac0f01cbabb21",
"status": "affected",
"version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e",
"versionType": "git"
},
{
"lessThan": "9cebe4680bb9a72f80c6541eb24af06db7a1fbc9",
"status": "affected",
"version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e",
"versionType": "git"
},
{
"lessThan": "47330cc875b36a1cf7b3543cb2cf90a7c603ce0e",
"status": "affected",
"version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e",
"versionType": "git"
},
{
"lessThan": "60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff",
"status": "affected",
"version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e",
"versionType": "git"
},
{
"lessThan": "525daaea459fc215f432de1b8debbd9144bf97b0",
"status": "affected",
"version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e",
"versionType": "git"
},
{
"status": "affected",
"version": "4bf367fa1fefabdf14938d0ac9ed60020389112e",
"versionType": "git"
},
{
"status": "affected",
"version": "3b382555706558f5c0587862b6dc03e96a252bba",
"versionType": "git"
},
{
"lessThan": "5.19",
"status": "affected",
"version": "5.18.18",
"versionType": "semver"
},
{
"lessThan": "5.20",
"status": "affected",
"version": "5.19.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.18.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.19.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close\n\nSince hci_dev_close_sync() can now be called during the reset path, we\nshould also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts\nwhile the hdev workqueue is being drained."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - This is a Bluetooth HCI subsystem bug where exploitation requires concurrent HCI controller events from the radio during adapter close/reset; on phones and laptops with Bluetooth enabled in public spaces, a nearby attacker can supply that traffic while the kernel tears down the adapter.\nAC:L - The attacker controls both sides of the race by timing Bluetooth traffic against adapter reset/close or error-recovery teardown, and syzbot reliably reproduced the original workqueue-drain class of this bug.\nPR:N - No local credentials are required on the remote path: a nearby Bluetooth attacker can drive ncmd/cmd timeout recovery that calls hci_dev_do_close() \u2192 hci_dev_close_sync(); local CAP_NET_ADMIN ioctl reset is an additional reachable path via user namespaces.\nUI:N - Exploitation does not require the victim to perform a specific action beyond having Bluetooth enabled, which is the default on most mobile and laptop deployments.\nS:U - Impact is confined to kernel Bluetooth/HCI state and does not cross a security boundary such as a VM escape or sandbox breakout.\nC:H - Queueing work onto a draining workqueue corrupts kernel workqueue metadata for cmd_timer/ncmd_timer delayed-work structures, which is memory corruption that could be leveraged for information disclosure during the close/open reset cycle.\nI:H - The workqueue invariant violation leaves delayed-work items in inconsistent states on a persistent hdev-\u003eworkqueue that is reused after reset, creating a plausible path to control-flow hijack via corrupted work callbacks.\nA:H - Triggering this bug produces a kernel WARNING in __queue_work() (kernel panic on panic_on_warn systems) and can cause drain_workqueue() to spin with repeated reflush attempts, denying Bluetooth availability and potentially hanging the adapter teardown path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:27:25.652Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ccf07dfb9d7d1e2c7a1eeb782f90d9b614ebba9c"
},
{
"url": "https://git.kernel.org/stable/c/7b81c1378b79c3143ca3fdb3d18ac0f01cbabb21"
},
{
"url": "https://git.kernel.org/stable/c/9cebe4680bb9a72f80c6541eb24af06db7a1fbc9"
},
{
"url": "https://git.kernel.org/stable/c/47330cc875b36a1cf7b3543cb2cf90a7c603ce0e"
},
{
"url": "https://git.kernel.org/stable/c/60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff"
},
{
"url": "https://git.kernel.org/stable/c/525daaea459fc215f432de1b8debbd9144bf97b0"
}
],
"title": "Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63974",
"datePublished": "2026-07-19T14:55:59.994Z",
"dateReserved": "2026-07-19T07:54:57.024Z",
"dateUpdated": "2026-10-30T12:27:25.652Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63996 (GCVE-0-2026-63996)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-10-19 20:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ethtool: cmis: require exact CDB reply length
Malicious SFP module could respond with rpl_len longer than
what cmis_cdb_process_reply() expected, leading to OOB writes.
Malicious HW is a bit theoretical but some modules may just
be buggy and/or the reads may occasionally get corrupted,
so let's protect the kernel.
The existing check protects from short replies. We need to
protect from long ones, too. All callers that pass a non-zero
rpl_exp_len cast the reply payload to a fixed-layout struct
and read fields at fixed offsets, with no version negotiation
or short-reply handling:
- cmis_cdb_validate_password()
- cmis_cdb_module_features_get()
- cmis_fw_update_fw_mng_features_get()
so let's assume that responses longer than expected do not
have to be handled gracefully here. Add a warning message
to make the debug easier in case my understanding is wrong...
Note that page_data->length (argument of kmalloc) comes from
last arg to ethtool_cmis_page_init() which is rpl_exp_len.
Note2 that AIs also like to point out overflows in args->req.payload
itself (which is a fixed-size 120 B buffer, on the stack),
but callers should be reading structs defined by the standard,
so protecting from requests for more data than max seem like
defensive programming.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63996",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:34:56.047648Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:18:01.872Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ethtool/cmis_cdb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2f818cc98fd2c63a08239cb48995f6c3bfe9d9b3",
"status": "affected",
"version": "a39c84d796254e6b1662ca0c46dbc313379e9291",
"versionType": "git"
},
{
"lessThan": "4d42fb88ec61f2e98c33a9e3a2de371d5edbc6b1",
"status": "affected",
"version": "a39c84d796254e6b1662ca0c46dbc313379e9291",
"versionType": "git"
},
{
"lessThan": "eb5dcd740cd7fa27bc2caeff2d28ef28e93ff4d3",
"status": "affected",
"version": "a39c84d796254e6b1662ca0c46dbc313379e9291",
"versionType": "git"
},
{
"lessThan": "6c3f999a9d1338c6c89a9ff4549eafe72bc2e7b1",
"status": "affected",
"version": "a39c84d796254e6b1662ca0c46dbc313379e9291",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ethtool/cmis_cdb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: cmis: require exact CDB reply length\n\nMalicious SFP module could respond with rpl_len longer than\nwhat cmis_cdb_process_reply() expected, leading to OOB writes.\nMalicious HW is a bit theoretical but some modules may just\nbe buggy and/or the reads may occasionally get corrupted,\nso let\u0027s protect the kernel.\n\nThe existing check protects from short replies. We need to\nprotect from long ones, too. All callers that pass a non-zero\nrpl_exp_len cast the reply payload to a fixed-layout struct\nand read fields at fixed offsets, with no version negotiation\nor short-reply handling:\n\n - cmis_cdb_validate_password()\n - cmis_cdb_module_features_get()\n - cmis_fw_update_fw_mng_features_get()\n\nso let\u0027s assume that responses longer than expected do not\nhave to be handled gracefully here. Add a warning message\nto make the debug easier in case my understanding is wrong...\n\nNote that page_data-\u003elength (argument of kmalloc) comes from\nlast arg to ethtool_cmis_page_init() which is rpl_exp_len.\n\nNote2 that AIs also like to point out overflows in args-\u003ereq.payload\nitself (which is a fixed-size 120 B buffer, on the stack),\nbut callers should be reading structs defined by the standard,\nso protecting from requests for more data than max seem like\ndefensive programming."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached only via the local ethtool genetlink firmware-flash path (ETHTOOL_MSG_MODULE_FW_FLASH_ACT), not from remote network input; a malicious transceiver supplies the malformed CDB reply once that local ioctl-like operation is invoked.\nAC:L - A malicious CMIS module can reliably set rpl_len up to 255 on CDB replies; no race or uncontrollable memory layout is required, and an attacker with CAP_NET_ADMIN can bring the netdev down and initiate flashing deterministically.\nPR:L - Triggering module firmware flash requires CAP_NET_ADMIN, which is enforced via GENL_UNS_ADMIN_PERM/netlink_ns_capable and is obtainable by unprivileged users inside a user namespace (unshare -Urn), not only by init-namespace root.\nUI:N - Exploitation does not require a separate victim user action beyond the attacker (or compromised local process with CAP_NET_ADMIN) issuing the ethtool module firmware-flash command; no interactive victim steps are needed.\nS:U - Impact is kernel stack corruption and potential privilege escalation or denial of service within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary crossing.\nC:H - The out-of-bounds stack write corrupts adjacent kernel stack memory and can be leveraged for arbitrary kernel memory disclosure; related CMIS ethtool bugs in the same path have already caused demonstrable stack corruption.\nI:H - memcpy() can write up to 135 bytes past the 120-byte payload buffer on the kernel stack, enabling control-data corruption and potential arbitrary kernel code execution, not merely a bounded modification.\nA:H - Stack corruption in this CMIS firmware-flash workqueue path can trigger kernel oops/panic (as seen in the related CVE-2025-37791 stack-protector failure in the same call chain) or hang the affected system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:38:00.530Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2f818cc98fd2c63a08239cb48995f6c3bfe9d9b3"
},
{
"url": "https://git.kernel.org/stable/c/4d42fb88ec61f2e98c33a9e3a2de371d5edbc6b1"
},
{
"url": "https://git.kernel.org/stable/c/eb5dcd740cd7fa27bc2caeff2d28ef28e93ff4d3"
},
{
"url": "https://git.kernel.org/stable/c/6c3f999a9d1338c6c89a9ff4549eafe72bc2e7b1"
}
],
"title": "ethtool: cmis: require exact CDB reply length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63996",
"datePublished": "2026-07-19T14:56:15.256Z",
"dateReserved": "2026-07-19T07:54:57.026Z",
"dateUpdated": "2026-10-19T20:18:01.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89932 (GCVE-0-2026-89932)
Vulnerability from cvelistv5
Published
2026-09-16 10:32
Modified
2026-10-19 08:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: nVMX: Always flush vpid02 on first use
Make sure vpid02 is always flushed on first use by setting last_vpid=0
when allocating vpid02. nested_vmx_transition_tlb_flush() will always
detect a VPID change on first VM-Enter after VMXON, because VPID=0 in
vmcs12 is not allowed if L1 enables VPID.
This avoids using stale TLB entries from a previous lifetime of the
VPID, that might have been associated with a different vCPU (or a
completely different VM).
Note that last_vpid is already being initialized as 0 when the vCPU is
created, but it is not reset when vpid02 is freed on VMXOFF. Hence, the
problem can only occur if L1 does VMXOFF -> VMXON, runs an L2, and KVM
happens to reuse a VPID that has TLB entries on the physical CPU.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0 Version: 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0 Version: 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0 Version: 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0 Version: 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0 Version: 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0 Version: 5c614b3583e7b6dab0c86356fa36c2bcbb8322a0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/vmx/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "26de0d2d9a8d14c03e5ebb25fd68b5bfcd5ac366",
"status": "affected",
"version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
"versionType": "git"
},
{
"lessThan": "8bc609999ec223089fec8d74c7de27d689606b36",
"status": "affected",
"version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
"versionType": "git"
},
{
"lessThan": "62604376c313178811375f40a282fc2a46cd2311",
"status": "affected",
"version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
"versionType": "git"
},
{
"lessThan": "8b98d662ab24f34710a56e03bc9169e4a5508606",
"status": "affected",
"version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
"versionType": "git"
},
{
"lessThan": "22dfcc22c95e91295119a1c3b469816ce44c4804",
"status": "affected",
"version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
"versionType": "git"
},
{
"lessThan": "121991d150735f3c0f7401678ce4d35c5b4ac898",
"status": "affected",
"version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
"versionType": "git"
},
{
"lessThan": "f0772389413dce9657c7d6950abf3edbbd511356",
"status": "affected",
"version": "5c614b3583e7b6dab0c86356fa36c2bcbb8322a0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/vmx/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Always flush vpid02 on first use\n\nMake sure vpid02 is always flushed on first use by setting last_vpid=0\nwhen allocating vpid02. nested_vmx_transition_tlb_flush() will always\ndetect a VPID change on first VM-Enter after VMXON, because VPID=0 in\nvmcs12 is not allowed if L1 enables VPID.\n\nThis avoids using stale TLB entries from a previous lifetime of the\nVPID, that might have been associated with a different vCPU (or a\ncompletely different VM).\n\nNote that last_vpid is already being initialized as 0 when the vCPU is\ncreated, but it is not reset when vpid02 is freed on VMXOFF. Hence, the\nproblem can only occur if L1 does VMXOFF -\u003e VMXON, runs an L2, and KVM\nhappens to reuse a VPID that has TLB entries on the physical CPU."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Reached when an L1 nested-VMX guest executes VMXOFF then VMXON and VMLAUNCH/VMRESUME on the host KVM_RUN path (handle_vmxon/enter_vmx_operation into nested_vmx_transition_tlb_flush); no network, adjacent-radio, or physical path hits nVMX VPID allocation.\nAC:L - The L1 attacker fully controls VMXOFF, VMXON, vmcs12 VPID, and vCPU pinning; allocate_vpid() is a deterministic global bitmap, nested VMX and VPID are default, and skipping last_vpid=0 makes the omitted INVVPID on first VM-Enter after VMXON reliably hit.\nPR:L - Needs /dev/kvm and nested VMX, typically a kvm-group user or cloud tenant running QEMU, not init-namespace root; handle_vmxon() only checks guest CPL=0 and CR4.VMXE, and KVM create/run ioctls have no CAP_SYS_ADMIN gate.\nUI:N - Once the attacker has a nested-capable VM, they trigger the flaw with their own VMXOFF/VMXON and VMLAUNCH; no separate victim action such as attaching a device or mounting a filesystem is required.\nS:C - Skipping the vpid02 INVVPID lets L2 use stale hardware TLB entries from a previous lifetime of that VPID, including another vCPU or a different VM, crossing KVM guest isolation so impact is outside L1\u0027s security authority.\nC:H - Reused vpid02 linear or combined TLB entries can translate L2 loads onto another VM\u0027s or recycled host physical pages, giving a read primitive over co-resident guest memory rather than a bounded pointer leak.\nI:H - The same stale translations apply to stores, so L2 can write through another VM\u0027s cached GPA/HPA mappings, corrupting co-resident guest memory and enabling control-flow hijack in the victim VM or further host compromise if pages were reused.\nA:H - Stale VPID hits produce wrong translations that surface as KVM internal/emulation failures and can oops or panic the host when walks land on recycled or unmapped host pages, denying service to the hypervisor and co-located VMs."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:55:06.898Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/26de0d2d9a8d14c03e5ebb25fd68b5bfcd5ac366"
},
{
"url": "https://git.kernel.org/stable/c/8bc609999ec223089fec8d74c7de27d689606b36"
},
{
"url": "https://git.kernel.org/stable/c/62604376c313178811375f40a282fc2a46cd2311"
},
{
"url": "https://git.kernel.org/stable/c/8b98d662ab24f34710a56e03bc9169e4a5508606"
},
{
"url": "https://git.kernel.org/stable/c/22dfcc22c95e91295119a1c3b469816ce44c4804"
},
{
"url": "https://git.kernel.org/stable/c/121991d150735f3c0f7401678ce4d35c5b4ac898"
},
{
"url": "https://git.kernel.org/stable/c/f0772389413dce9657c7d6950abf3edbbd511356"
}
],
"title": "KVM: nVMX: Always flush vpid02 on first use",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89932",
"datePublished": "2026-09-16T10:32:22.886Z",
"dateReserved": "2026-09-11T19:38:34.776Z",
"dateUpdated": "2026-10-19T08:55:06.898Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63993 (GCVE-0-2026-63993)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-10-19 20:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
skb_tunnel_check_pmtu() can change skb->head.
Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF.
Use instead ip_hdr(skb) as done in drivers/net/bareudp.c
and drivers/net/geneve.c.
Found by Sashiko.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f Version: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f Version: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f Version: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f Version: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f Version: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f Version: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f Version: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63993",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:34:49.188699Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:18:01.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6b8bfce9d2f774d2c2243e0248e03efb99bba6c0",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "9257f56ac47ef1976bcd056cf986a9988eeec67a",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "8d435d68d71fb875876b722f4136caf74f2f48bd",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "dc3bfa050f873371e745bdf478b1f5b738e5733d",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "609e63312c29aad18026a1d3222e123d4b6b0feb",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "5303925e360527243b46a440a04667826bbc72b7",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "a493efd4336cf19122ae0e4cbb3d31b32d70deea",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "7d9ef0cb271555d8cf39fefe6c981e1493b25ecf",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()\n\nskb_tunnel_check_pmtu() can change skb-\u003ehead.\n\nReusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF.\n\nUse instead ip_hdr(skb) as done in drivers/net/bareudp.c\nand drivers/net/geneve.c.\n\nFound by Sashiko."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in VXLAN transmit processing reached when network-originated packets are decapsulated, bridged, and re-encapsulated; VXLAN is a UDP-based overlay protocol reachable from remote peers over the network.\nAC:L - An attacker can reliably trigger the bug by sending crafted oversized inner IPv4/IPv6 packets (e.g., with DF set or ICMP/ICMPv6 payloads) through a bridged VXLAN interface to force skb_tunnel_check_pmtu() to reallocate skb-\u003ehead yet return 0, leaving the cached ip_hdr pointer stale.\nPR:N - Exploitation requires only the ability to send VXLAN/inner IP traffic to a host with an active VXLAN bridge port; no local account, capabilities, or authentication on the victim is needed.\nUI:N - No victim user action is required beyond normal network operation; triggering the bug is entirely driven by attacker-supplied packets forwarded through the VXLAN device.\nS:U - The vulnerability corrupts kernel heap memory on the host processing the VXLAN traffic; impact remains within the kernel\u0027s security authority and does not inherently cross a VM or sandbox boundary.\nC:H - This is a use-after-free where ip_tunnel_ecn_encap() reads from a freed skb head via the stale cached ip_hdr pointer, enabling kernel memory disclosure and supporting further exploitation.\nI:H - Use-after-free on skb data provides a foundation for heap grooming and arbitrary memory write primitives that could be leveraged for kernel code execution or privilege escalation.\nA:H - The UAF can cause kernel oops/panic during transmit processing and is independently exploitable for denial of service even when full code execution is not achieved."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:57.287Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6b8bfce9d2f774d2c2243e0248e03efb99bba6c0"
},
{
"url": "https://git.kernel.org/stable/c/9257f56ac47ef1976bcd056cf986a9988eeec67a"
},
{
"url": "https://git.kernel.org/stable/c/8d435d68d71fb875876b722f4136caf74f2f48bd"
},
{
"url": "https://git.kernel.org/stable/c/dc3bfa050f873371e745bdf478b1f5b738e5733d"
},
{
"url": "https://git.kernel.org/stable/c/609e63312c29aad18026a1d3222e123d4b6b0feb"
},
{
"url": "https://git.kernel.org/stable/c/5303925e360527243b46a440a04667826bbc72b7"
},
{
"url": "https://git.kernel.org/stable/c/a493efd4336cf19122ae0e4cbb3d31b32d70deea"
},
{
"url": "https://git.kernel.org/stable/c/7d9ef0cb271555d8cf39fefe6c981e1493b25ecf"
}
],
"title": "vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63993",
"datePublished": "2026-07-19T14:56:13.218Z",
"dateReserved": "2026-07-19T07:54:57.025Z",
"dateUpdated": "2026-10-19T20:18:01.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80571 (GCVE-0-2026-80571)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-08-26 14:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
In papr_phy_attest_create_handle(), the params->cmd.length is not
validated before use, which can result in a buffer overlow. Check it and
return -EINVAL if it is either 0 or exceeds sizeof(params->cmd).
Also, params is freed on the success path but not error. Free it on
errors after memory allocation. And free it on negative fd.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/powerpc/platforms/pseries/papr-phy-attest.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "828a8d1a9107aec6353d896882df8383accf7e80",
"status": "affected",
"version": "86900ab620a42396a749b506d4a187820fc3fabe",
"versionType": "git"
},
{
"lessThan": "ed98ce338f9a65c90cb930b088f1eb36de7181af",
"status": "affected",
"version": "86900ab620a42396a749b506d4a187820fc3fabe",
"versionType": "git"
},
{
"lessThan": "5b17f3f34391372faf03e79d947e0c50ab6dd258",
"status": "affected",
"version": "86900ab620a42396a749b506d4a187820fc3fabe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/powerpc/platforms/pseries/papr-phy-attest.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak\n\nIn papr_phy_attest_create_handle(), the params-\u003ecmd.length is not\nvalidated before use, which can result in a buffer overlow. Check it and\nreturn -EINVAL if it is either 0 or exceeds sizeof(params-\u003ecmd).\n\nAlso, params is freed on the success path but not error. Free it on\nerrors after memory allocation. And free it on negative fd."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:37:32.541Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/828a8d1a9107aec6353d896882df8383accf7e80"
},
{
"url": "https://git.kernel.org/stable/c/ed98ce338f9a65c90cb930b088f1eb36de7181af"
},
{
"url": "https://git.kernel.org/stable/c/5b17f3f34391372faf03e79d947e0c50ab6dd258"
}
],
"title": "powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80571",
"datePublished": "2026-08-26T14:37:32.541Z",
"dateReserved": "2026-08-26T14:34:25.768Z",
"dateUpdated": "2026-08-26T14:37:32.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72243 (GCVE-0-2026-72243)
Vulnerability from cvelistv5
Published
2026-08-15 05:54
Modified
2026-10-16 18:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
selinux: check connect-related permissions on TCP Fast Open
Similar to Landlock, SELinux was not updated when TCP Fast Open
support was introduced to ensure connect-related permissions are
checked when using TCP Fast Open. Update its socket_sendmsg() hook to
call selinux_socket_connect() when MSG_FASTOPEN is passed.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cf60af03ca4e71134206809ea892e49b92a88896 Version: cf60af03ca4e71134206809ea892e49b92a88896 Version: cf60af03ca4e71134206809ea892e49b92a88896 Version: cf60af03ca4e71134206809ea892e49b92a88896 Version: cf60af03ca4e71134206809ea892e49b92a88896 Version: cf60af03ca4e71134206809ea892e49b92a88896 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72243",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:44:53.438037Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:45:04.616Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/selinux/hooks.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "11406d0d7e11b4e525bb2ace2c70107031d058da",
"status": "affected",
"version": "cf60af03ca4e71134206809ea892e49b92a88896",
"versionType": "git"
},
{
"lessThan": "e507633bf76bccf1a6af27771fb0d6e2862b7eac",
"status": "affected",
"version": "cf60af03ca4e71134206809ea892e49b92a88896",
"versionType": "git"
},
{
"lessThan": "d028bc080a0dcd6a7f8e1ae1bd32dda696505ba3",
"status": "affected",
"version": "cf60af03ca4e71134206809ea892e49b92a88896",
"versionType": "git"
},
{
"lessThan": "fc633a598206d4f23af782db7c0b5f3a82751d2c",
"status": "affected",
"version": "cf60af03ca4e71134206809ea892e49b92a88896",
"versionType": "git"
},
{
"lessThan": "646ebbc5f2ff9147d084e1213143f091026a611c",
"status": "affected",
"version": "cf60af03ca4e71134206809ea892e49b92a88896",
"versionType": "git"
},
{
"lessThan": "44c74d27d1b9aaa99fa8a83640c1223575262b80",
"status": "affected",
"version": "cf60af03ca4e71134206809ea892e49b92a88896",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/selinux/hooks.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: check connect-related permissions on TCP Fast Open\n\nSimilar to Landlock, SELinux was not updated when TCP Fast Open\nsupport was introduced to ensure connect-related permissions are\nchecked when using TCP Fast Open. Update its socket_sendmsg() hook to\ncall selinux_socket_connect() when MSG_FASTOPEN is passed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires a confined local process to invoke sendmsg(2)/sendto(2) with MSG_FASTOPEN; the vulnerable selinux_socket_sendmsg() LSM hook runs on the syscall path before TCP fast-open performs its implicit connect.\nAC:L - A confined task with SOCKET__WRITE can reliably trigger the bypass with one sendmsg/sendto using MSG_FASTOPEN and a destination address; TFO client is enabled by default (sysctl_tcp_fastopen=TFO_CLIENT_ENABLE) and no race or special victim state is needed.\nPR:L - The attacker must be an unprivileged process in a SELinux domain that grants socket write but denies connect/name_connect (e.g., confined Android apps, container workloads, hardened service domains); no real root or init-namespace privileges are required.\nUI:N - No victim interaction is required; the confined attacker process directly issues the bypassing syscall without needing another user or administrator to perform any action.\nS:C - Successful exploitation crosses the SELinux MAC confinement boundary, allowing a sandboxed domain to establish outbound TCP/MPTCP connections that connect(2) and name_connect policy would have blocked, escaping the intended network policy scope.\nC:H - Bypassing connect and name_connect mediation lets a confined process open TCP/MPTCP sessions to SELinux-forbidden destinations and read arbitrary response data from those services (internal APIs, metadata endpoints, databases), constituting unauthorized information disclosure.\nI:H - The bypass enables unauthorized outbound connection establishment and transmission of arbitrary application data (including SYN-cookie payload) to hosts and ports explicitly denied by SELinux connect/name_connect rules, violating integrity of the confinement policy.\nA:N - This is a pure SELinux LSM policy-bypass flaw with no kernel memory corruption, panic, oops, hang, or resource exhaustion; exploitation does not impact system availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T06:56:32.099Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/11406d0d7e11b4e525bb2ace2c70107031d058da"
},
{
"url": "https://git.kernel.org/stable/c/e507633bf76bccf1a6af27771fb0d6e2862b7eac"
},
{
"url": "https://git.kernel.org/stable/c/d028bc080a0dcd6a7f8e1ae1bd32dda696505ba3"
},
{
"url": "https://git.kernel.org/stable/c/fc633a598206d4f23af782db7c0b5f3a82751d2c"
},
{
"url": "https://git.kernel.org/stable/c/646ebbc5f2ff9147d084e1213143f091026a611c"
},
{
"url": "https://git.kernel.org/stable/c/44c74d27d1b9aaa99fa8a83640c1223575262b80"
}
],
"title": "selinux: check connect-related permissions on TCP Fast Open",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72243",
"datePublished": "2026-08-15T05:54:31.117Z",
"dateReserved": "2026-08-09T03:40:39.914Z",
"dateUpdated": "2026-10-16T18:45:04.616Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80864 (GCVE-0-2026-80864)
Vulnerability from cvelistv5
Published
2026-09-04 15:55
Modified
2026-10-30 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
rxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the
IB_QP_STATE path, so it holds no state_lock and runs while the responder
task rxe_receiver() (recv_task on rxe_wq) is live. A modify_qp() setting
only that attribute calls free_rd_atomic_resources() then
alloc_rd_atomic_resources(), swapping qp->resp.resources[] while
rxe_prepare_res()/find_resource() walk it; free_rd_atomic_resources()
also leaves the cached pointer qp->resp.res dangling. A local
unprivileged user can race the free/realloc into a use-after-free in
rxe_receiver() (local DoS).
Drain recv_task around the swap with rxe_disable_task()/rxe_enable_task(),
as rxe_qp_reset() already does when tearing this array down, re-enabling
only after alloc_rd_atomic_resources() succeeds so the responder never
resumes against a NULL qp->resp.resources on the ENOMEM path. Also clear
qp->resp.res in free_rd_atomic_resources(), like the rxe_resp.c
completion paths.
Reproduced under KASAN; the slab-use-after-free in rxe_receiver() is gone.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_qp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "87e40635d77aa19088550698c81eb295d5131f71",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "82257379061c0a7aba6c77081d988339982af115",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "0136b528b753c5a56e4d997ef20b86bb6750b8fb",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "ffa4f0be69656be1755090f02db38d49816585c6",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "d4cd32eb8bd2b0ffbdc7b1f3d82ce6a371f8f844",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "60dfd47929cd1e7070daa810d40ce538d888410d",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "6f7014237405e7f032b5c53a82d9eccf6161c291",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_qp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.108",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.49",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.13",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.3",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp\n\nrxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the\nIB_QP_STATE path, so it holds no state_lock and runs while the responder\ntask rxe_receiver() (recv_task on rxe_wq) is live. A modify_qp() setting\nonly that attribute calls free_rd_atomic_resources() then\nalloc_rd_atomic_resources(), swapping qp-\u003eresp.resources[] while\nrxe_prepare_res()/find_resource() walk it; free_rd_atomic_resources()\nalso leaves the cached pointer qp-\u003eresp.res dangling. A local\nunprivileged user can race the free/realloc into a use-after-free in\nrxe_receiver() (local DoS).\n\nDrain recv_task around the swap with rxe_disable_task()/rxe_enable_task(),\nas rxe_qp_reset() already does when tearing this array down, re-enabling\nonly after alloc_rd_atomic_resources() succeeds so the responder never\nresumes against a NULL qp-\u003eresp.resources on the ENOMEM path. Also clear\nqp-\u003eresp.res in free_rd_atomic_resources(), like the rxe_resp.c\ncompletion paths.\n\nReproduced under KASAN; the slab-use-after-free in rxe_receiver() is gone."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:31:20.192Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/87e40635d77aa19088550698c81eb295d5131f71"
},
{
"url": "https://git.kernel.org/stable/c/82257379061c0a7aba6c77081d988339982af115"
},
{
"url": "https://git.kernel.org/stable/c/0136b528b753c5a56e4d997ef20b86bb6750b8fb"
},
{
"url": "https://git.kernel.org/stable/c/ffa4f0be69656be1755090f02db38d49816585c6"
},
{
"url": "https://git.kernel.org/stable/c/d4cd32eb8bd2b0ffbdc7b1f3d82ce6a371f8f844"
},
{
"url": "https://git.kernel.org/stable/c/60dfd47929cd1e7070daa810d40ce538d888410d"
},
{
"url": "https://git.kernel.org/stable/c/6f7014237405e7f032b5c53a82d9eccf6161c291"
}
],
"title": "RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80864",
"datePublished": "2026-09-04T15:55:18.791Z",
"dateReserved": "2026-08-26T14:34:25.798Z",
"dateUpdated": "2026-10-30T12:31:20.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74510 (GCVE-0-2026-74510)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: mgmt: fix UAF in pair command cancellation
The pairing completion and authentication failure callbacks look up the
pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending. The
lookup returned a command that was still linked on the shared pending list,
without keeping mgmt_pending_lock held for the later dereference and
removal.
A concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the
same pending command before the callback uses it. The reverse race is also
possible when cancel_pair_device() gets a command from pending_find() and a
callback removes it before the cancel path dereferences it. This can lead
to a use-after-free and a second list_del().
Make the pairing lookup helpers transfer ownership of the pending command
by removing it from hdev->mgmt_pending while holding mgmt_pending_lock.
The callbacks and cancel path then complete the command and free it
directly, so racing paths cannot find or free the same command again. Take
a temporary hci_conn reference in cancel_pair_device() because the command
completion drops the reference stored in the pending command.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 Version: e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 Version: e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 Version: e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 Version: e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 Version: e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74510",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:58:39.693080Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:51.530Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "50af4280a587c9971b5388cbc438f1324e626b7b",
"status": "affected",
"version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
"versionType": "git"
},
{
"lessThan": "86ed4dd6548ccf277bc691bc912ca06e76b9d80c",
"status": "affected",
"version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
"versionType": "git"
},
{
"lessThan": "7c2a152a897cd1c184b2051484d4f74d803e7f4a",
"status": "affected",
"version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
"versionType": "git"
},
{
"lessThan": "c569def320aa8b1fde89227e2ea96606790fd86d",
"status": "affected",
"version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
"versionType": "git"
},
{
"lessThan": "51be7280980fddc90ebe874a69c2fe8ab02bb46a",
"status": "affected",
"version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
"versionType": "git"
},
{
"lessThan": "d0a7b48ad0921bd88effaee10bf970ab1d5d0ddd",
"status": "affected",
"version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.39"
},
{
"lessThan": "2.6.39",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.39",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix UAF in pair command cancellation\n\nThe pairing completion and authentication failure callbacks look up the\npending MGMT_OP_PAIR_DEVICE command by walking hdev-\u003emgmt_pending. The\nlookup returned a command that was still linked on the shared pending list,\nwithout keeping mgmt_pending_lock held for the later dereference and\nremoval.\n\nA concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the\nsame pending command before the callback uses it. The reverse race is also\npossible when cancel_pair_device() gets a command from pending_find() and a\ncallback removes it before the cancel path dereferences it. This can lead\nto a use-after-free and a second list_del().\n\nMake the pairing lookup helpers transfer ownership of the pending command\nby removing it from hdev-\u003emgmt_pending while holding mgmt_pending_lock.\nThe callbacks and cancel path then complete the command and free it\ndirectly, so racing paths cannot find or free the same command again. Take\na temporary hci_conn reference in cancel_pair_device() because the command\ncompletion drops the reference stored in the pending command."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is triggered through local AF_BLUETOOTH HCI_CHANNEL_CONTROL management commands (hci_sock_bind/sendmsg -\u003e hci_mgmt_cmd -\u003e pair_device/cancel_pair_device); remote Bluetooth peers cannot issue MGMT_OP_PAIR_DEVICE or MGMT_OP_CANCEL_PAIR_DEVICE over the air.\nAC:L - An attacker controls the race by concurrently issuing MGMT_OP_PAIR_DEVICE and MGMT_OP_CANCEL_PAIR_DEVICE from threads or sockets they own while pairing HCI callbacks fire, and can retry until cancel and completion/auth/SMP paths interleave on the same pending command.\nPR:L - pair_device and cancel_pair_device lack HCI_MGMT_UNTRUSTED and require HCI_SOCK_TRUSTED (CAP_NET_ADMIN at bind); per kernel CNA guidance CAP_NET_ADMIN reachable via unprivileged user namespaces (unshare -Urn) maps to PR:L, consistent with similar Bluetooth mgmt UAF scores.\nUI:N - No victim interaction is required beyond a powered Bluetooth controller; the attacker directly sends the conflicting PAIR_DEVICE and CANCEL_PAIR_DEVICE management commands that create the pending entry and race the unlocked find_pairing/pending_find paths against completion callbacks.\nS:U - Exploitation corrupts kernel Bluetooth MGMT heap objects (mgmt_pending_cmd) within the same host kernel security authority; this is standard local kernel memory corruption, not a VM, IOMMU, or cross-authority boundary escape.\nC:H - Use-after-free of mgmt_pending_cmd when find_pairing or pending_find returns a still-linked command without holding mgmt_pending_lock through later dereference and mgmt_pending_remove, enabling arbitrary kernel memory disclosure via slab reuse of the freed object.\nI:H - Slab UAF and double list_del on mgmt_pending_cmd during concurrent cancel_pair_device and pairing/auth/SMP completion callbacks provide attacker-influenced heap corruption primitives exploitable for arbitrary kernel writes and control-flow hijacking per kernel UAF guidance.\nA:H - Dereferencing or list_del on a freed mgmt_pending_cmd during the cancel versus callback race causes kernel oops or panic; repeated concurrent PAIR_DEVICE and CANCEL_PAIR_DEVICE commands during active pairing can reliably crash or hang the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:47:31.049Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/50af4280a587c9971b5388cbc438f1324e626b7b"
},
{
"url": "https://git.kernel.org/stable/c/86ed4dd6548ccf277bc691bc912ca06e76b9d80c"
},
{
"url": "https://git.kernel.org/stable/c/7c2a152a897cd1c184b2051484d4f74d803e7f4a"
},
{
"url": "https://git.kernel.org/stable/c/c569def320aa8b1fde89227e2ea96606790fd86d"
},
{
"url": "https://git.kernel.org/stable/c/51be7280980fddc90ebe874a69c2fe8ab02bb46a"
},
{
"url": "https://git.kernel.org/stable/c/d0a7b48ad0921bd88effaee10bf970ab1d5d0ddd"
}
],
"title": "Bluetooth: mgmt: fix UAF in pair command cancellation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74510",
"datePublished": "2026-08-15T12:27:32.503Z",
"dateReserved": "2026-08-15T05:44:03.909Z",
"dateUpdated": "2026-10-16T19:05:51.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-50315 (GCVE-0-2022-50315)
Vulnerability from cvelistv5
Published
2025-09-15 14:46
Modified
2026-10-15 21:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
UBSAN complains about array-index-out-of-bounds:
[ 1.980703] kernel: UBSAN: array-index-out-of-bounds in /build/linux-9H675w/linux-5.15.0/drivers/ata/libahci.c:968:41
[ 1.980709] kernel: index 15 is out of range for type 'ahci_em_priv [8]'
[ 1.980713] kernel: CPU: 0 PID: 209 Comm: scsi_eh_8 Not tainted 5.15.0-25-generic #25-Ubuntu
[ 1.980716] kernel: Hardware name: System manufacturer System Product Name/P5Q3, BIOS 1102 06/11/2010
[ 1.980718] kernel: Call Trace:
[ 1.980721] kernel: <TASK>
[ 1.980723] kernel: show_stack+0x52/0x58
[ 1.980729] kernel: dump_stack_lvl+0x4a/0x5f
[ 1.980734] kernel: dump_stack+0x10/0x12
[ 1.980736] kernel: ubsan_epilogue+0x9/0x45
[ 1.980739] kernel: __ubsan_handle_out_of_bounds.cold+0x44/0x49
[ 1.980742] kernel: ahci_qc_issue+0x166/0x170 [libahci]
[ 1.980748] kernel: ata_qc_issue+0x135/0x240
[ 1.980752] kernel: ata_exec_internal_sg+0x2c4/0x580
[ 1.980754] kernel: ? vprintk_default+0x1d/0x20
[ 1.980759] kernel: ata_exec_internal+0x67/0xa0
[ 1.980762] kernel: sata_pmp_read+0x8d/0xc0
[ 1.980765] kernel: sata_pmp_read_gscr+0x3c/0x90
[ 1.980768] kernel: sata_pmp_attach+0x8b/0x310
[ 1.980771] kernel: ata_eh_revalidate_and_attach+0x28c/0x4b0
[ 1.980775] kernel: ata_eh_recover+0x6b6/0xb30
[ 1.980778] kernel: ? ahci_do_hardreset+0x180/0x180 [libahci]
[ 1.980783] kernel: ? ahci_stop_engine+0xb0/0xb0 [libahci]
[ 1.980787] kernel: ? ahci_do_softreset+0x290/0x290 [libahci]
[ 1.980792] kernel: ? trace_event_raw_event_ata_eh_link_autopsy_qc+0xe0/0xe0
[ 1.980795] kernel: sata_pmp_eh_recover.isra.0+0x214/0x560
[ 1.980799] kernel: sata_pmp_error_handler+0x23/0x40
[ 1.980802] kernel: ahci_error_handler+0x43/0x80 [libahci]
[ 1.980806] kernel: ata_scsi_port_error_handler+0x2b1/0x600
[ 1.980810] kernel: ata_scsi_error+0x9c/0xd0
[ 1.980813] kernel: scsi_error_handler+0xa1/0x180
[ 1.980817] kernel: ? scsi_unjam_host+0x1c0/0x1c0
[ 1.980820] kernel: kthread+0x12a/0x150
[ 1.980823] kernel: ? set_kthread_struct+0x50/0x50
[ 1.980826] kernel: ret_from_fork+0x22/0x30
[ 1.980831] kernel: </TASK>
This happens because sata_pmp_init_links() initialize link->pmp up to
SATA_PMP_MAX_PORTS while em_priv is declared as 8 elements array.
I can't find the maximum Enclosure Management ports specified in AHCI
spec v1.3.1, but "12.2.1 LED message type" states that "Port Multiplier
Information" can utilize 4 bits, which implies it can support up to 16
ports. Hence, use SATA_PMP_MAX_PORTS as EM_MAX_SLOTS to resolve the
issue.
BugLink: https://bugs.launchpad.net/bugs/1970074
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee Version: 18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee Version: 18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee Version: 18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee Version: 18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee Version: 18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee Version: 18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee Version: 18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-50315",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T21:30:53.570401Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:31:19.964Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ata/ahci.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f70bd4339cb68bc7e206af4c922bc0d249244403",
"status": "affected",
"version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
"versionType": "git"
},
{
"lessThan": "da2ea4a961d9f89ed248734e7032350c260dc3a3",
"status": "affected",
"version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
"versionType": "git"
},
{
"lessThan": "67a00c299c5c143817c948fbc7de1a2fa1af38fb",
"status": "affected",
"version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
"versionType": "git"
},
{
"lessThan": "383b7c50f5445ff8dbbf03080905648d6980c39d",
"status": "affected",
"version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
"versionType": "git"
},
{
"lessThan": "303d0f761431d848dd8d7ff9fd9b8c101879cabe",
"status": "affected",
"version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
"versionType": "git"
},
{
"lessThan": "8fbe13de1cc7cef2564be3cbf60400b33eee023b",
"status": "affected",
"version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
"versionType": "git"
},
{
"lessThan": "d6314d5f68764550c84d732ce901ddd3ac6b415f",
"status": "affected",
"version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
"versionType": "git"
},
{
"lessThan": "1e41e693f458eef2d5728207dbd327cd3b16580a",
"status": "affected",
"version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ata/ahci.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.332",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.298",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.264",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.76",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.332",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.298",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.264",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.221",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.152",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.76",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.6",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "2.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS\n\nUBSAN complains about array-index-out-of-bounds:\n[ 1.980703] kernel: UBSAN: array-index-out-of-bounds in /build/linux-9H675w/linux-5.15.0/drivers/ata/libahci.c:968:41\n[ 1.980709] kernel: index 15 is out of range for type \u0027ahci_em_priv [8]\u0027\n[ 1.980713] kernel: CPU: 0 PID: 209 Comm: scsi_eh_8 Not tainted 5.15.0-25-generic #25-Ubuntu\n[ 1.980716] kernel: Hardware name: System manufacturer System Product Name/P5Q3, BIOS 1102 06/11/2010\n[ 1.980718] kernel: Call Trace:\n[ 1.980721] kernel: \u003cTASK\u003e\n[ 1.980723] kernel: show_stack+0x52/0x58\n[ 1.980729] kernel: dump_stack_lvl+0x4a/0x5f\n[ 1.980734] kernel: dump_stack+0x10/0x12\n[ 1.980736] kernel: ubsan_epilogue+0x9/0x45\n[ 1.980739] kernel: __ubsan_handle_out_of_bounds.cold+0x44/0x49\n[ 1.980742] kernel: ahci_qc_issue+0x166/0x170 [libahci]\n[ 1.980748] kernel: ata_qc_issue+0x135/0x240\n[ 1.980752] kernel: ata_exec_internal_sg+0x2c4/0x580\n[ 1.980754] kernel: ? vprintk_default+0x1d/0x20\n[ 1.980759] kernel: ata_exec_internal+0x67/0xa0\n[ 1.980762] kernel: sata_pmp_read+0x8d/0xc0\n[ 1.980765] kernel: sata_pmp_read_gscr+0x3c/0x90\n[ 1.980768] kernel: sata_pmp_attach+0x8b/0x310\n[ 1.980771] kernel: ata_eh_revalidate_and_attach+0x28c/0x4b0\n[ 1.980775] kernel: ata_eh_recover+0x6b6/0xb30\n[ 1.980778] kernel: ? ahci_do_hardreset+0x180/0x180 [libahci]\n[ 1.980783] kernel: ? ahci_stop_engine+0xb0/0xb0 [libahci]\n[ 1.980787] kernel: ? ahci_do_softreset+0x290/0x290 [libahci]\n[ 1.980792] kernel: ? trace_event_raw_event_ata_eh_link_autopsy_qc+0xe0/0xe0\n[ 1.980795] kernel: sata_pmp_eh_recover.isra.0+0x214/0x560\n[ 1.980799] kernel: sata_pmp_error_handler+0x23/0x40\n[ 1.980802] kernel: ahci_error_handler+0x43/0x80 [libahci]\n[ 1.980806] kernel: ata_scsi_port_error_handler+0x2b1/0x600\n[ 1.980810] kernel: ata_scsi_error+0x9c/0xd0\n[ 1.980813] kernel: scsi_error_handler+0xa1/0x180\n[ 1.980817] kernel: ? scsi_unjam_host+0x1c0/0x1c0\n[ 1.980820] kernel: kthread+0x12a/0x150\n[ 1.980823] kernel: ? set_kthread_struct+0x50/0x50\n[ 1.980826] kernel: ret_from_fork+0x22/0x30\n[ 1.980831] kernel: \u003c/TASK\u003e\n\nThis happens because sata_pmp_init_links() initialize link-\u003epmp up to\nSATA_PMP_MAX_PORTS while em_priv is declared as 8 elements array.\n\nI can\u0027t find the maximum Enclosure Management ports specified in AHCI\nspec v1.3.1, but \"12.2.1 LED message type\" states that \"Port Multiplier\nInformation\" can utilize 4 bits, which implies it can support up to 16\nports. Hence, use SATA_PMP_MAX_PORTS as EM_MAX_SLOTS to resolve the\nissue.\n\nBugLink: https://bugs.launchpad.net/bugs/1970074"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The OOB is reached through AHCI enclosure-management paths on systems with a SATA port multiplier (common on NAS/DAS and eSATA setups). A local attacker triggers it via world-readable sysfs (em_message) and normal ATA/PMP command processing, without needing network access.\nAC:L - Once an AHCI host with enclosure management and a PMP is present, the out-of-bounds em_priv[link-\u003epmp] access is deterministic on PMP attach, LED sysfs reads, port resume, and I/O\u2014no race or other attacker-uncontrollable condition is required.\nPR:L - em_message is S_IRUGO, so an unprivileged local user can force OOB reads of adjacent kernel heap via ahci_led_show for PMP port indices \u003e= 8. Port resume and related EM paths that write past em_priv[] also do not require root capabilities beyond normal local access.\nUI:N - Exploitation does not need a victim to open a file or mount anything; attaching/operating the PMP and reading host sysfs attributes is sufficient, and the bug also fires from kernel EH/resume context without user interaction.\nS:U - Impact is confined to the host kernel\u2019s memory and control flow (heap OOB in ahci_port_priv). There is no VM/hypervisor escape or other cross-authority boundary crossing.\nC:H - ahci_led_show and related EM paths read em_priv[link-\u003epmp] past the 8-slot array into adjacent heap and return those values to userspace, enabling disclosure of kernel memory; heap corruption from the write paths can further yield arbitrary read primitives.\nI:H - For PMP indices \u003e= 8, ahci_init_sw_activity performs OOB writes (including timer_setup of a timer_list) into memory past em_priv[], and ahci_sw_activity/ahci_activity_store can likewise corrupt adjacent heap\u2014classic primitives for control-flow hijacking.\nA:H - Out-of-bounds heap reads/writes and corrupted timer_list state can oops/panic the kernel; the same paths run in SCSI error-handler/resume context where memory corruption reliably threatens system availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T08:58:09.941Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f70bd4339cb68bc7e206af4c922bc0d249244403"
},
{
"url": "https://git.kernel.org/stable/c/da2ea4a961d9f89ed248734e7032350c260dc3a3"
},
{
"url": "https://git.kernel.org/stable/c/67a00c299c5c143817c948fbc7de1a2fa1af38fb"
},
{
"url": "https://git.kernel.org/stable/c/383b7c50f5445ff8dbbf03080905648d6980c39d"
},
{
"url": "https://git.kernel.org/stable/c/303d0f761431d848dd8d7ff9fd9b8c101879cabe"
},
{
"url": "https://git.kernel.org/stable/c/8fbe13de1cc7cef2564be3cbf60400b33eee023b"
},
{
"url": "https://git.kernel.org/stable/c/d6314d5f68764550c84d732ce901ddd3ac6b415f"
},
{
"url": "https://git.kernel.org/stable/c/1e41e693f458eef2d5728207dbd327cd3b16580a"
}
],
"title": "ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50315",
"datePublished": "2025-09-15T14:46:10.177Z",
"dateReserved": "2025-09-15T14:18:36.813Z",
"dateUpdated": "2026-10-15T21:31:19.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64303 (GCVE-0-2026-64303)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
When dmaengine_prep_slave_sg() fails for the TX channel, the error path
terminates the TX DMA channel but leaves the RX channel running. Since
the RX channel was already submitted and issued prior to preparing
the TX descriptor, returning -EINVAL causes the SPI core to unmap the
DMA buffers while the RX DMA engine continues writing to them, leading
to potential memory corruption or use-after-free.
Terminate the RX channel before returning on the TX prepare failure path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 09c04466ce7ea494993c0635ba5edb6d2222a806 Version: 09c04466ce7ea494993c0635ba5edb6d2222a806 Version: 09c04466ce7ea494993c0635ba5edb6d2222a806 Version: 09c04466ce7ea494993c0635ba5edb6d2222a806 Version: 09c04466ce7ea494993c0635ba5edb6d2222a806 Version: 09c04466ce7ea494993c0635ba5edb6d2222a806 Version: 09c04466ce7ea494993c0635ba5edb6d2222a806 Version: 09c04466ce7ea494993c0635ba5edb6d2222a806 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64303",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:38:43.370379Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:22.841Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-fsl-lpspi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ad370d1c7a9a832f77b2341513cd31188c9443af",
"status": "affected",
"version": "09c04466ce7ea494993c0635ba5edb6d2222a806",
"versionType": "git"
},
{
"lessThan": "cce2063404b2341e7b2bbf85eddfcd70a31a0033",
"status": "affected",
"version": "09c04466ce7ea494993c0635ba5edb6d2222a806",
"versionType": "git"
},
{
"lessThan": "af39a2698f69b584d14a00cffe0f51a2caa15337",
"status": "affected",
"version": "09c04466ce7ea494993c0635ba5edb6d2222a806",
"versionType": "git"
},
{
"lessThan": "e65505d91fa036a238968e4c10744244d1b968c4",
"status": "affected",
"version": "09c04466ce7ea494993c0635ba5edb6d2222a806",
"versionType": "git"
},
{
"lessThan": "d5c1060218a3749c8a18b36f8169d910fce20639",
"status": "affected",
"version": "09c04466ce7ea494993c0635ba5edb6d2222a806",
"versionType": "git"
},
{
"lessThan": "808033d80d5c9f8adf7e8de9317389270ce13430",
"status": "affected",
"version": "09c04466ce7ea494993c0635ba5edb6d2222a806",
"versionType": "git"
},
{
"lessThan": "9d000bdd250d649a11cd7f733175686877344582",
"status": "affected",
"version": "09c04466ce7ea494993c0635ba5edb6d2222a806",
"versionType": "git"
},
{
"lessThan": "01980b5da56e573d62798d0ff6c86bcaa2b22cbe",
"status": "affected",
"version": "09c04466ce7ea494993c0635ba5edb6d2222a806",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-fsl-lpspi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: fsl-lpspi: terminate the RX channel on TX prepare failure path\n\nWhen dmaengine_prep_slave_sg() fails for the TX channel, the error path\nterminates the TX DMA channel but leaves the RX channel running. Since\nthe RX channel was already submitted and issued prior to preparing\nthe TX descriptor, returning -EINVAL causes the SPI core to unmap the\nDMA buffers while the RX DMA engine continues writing to them, leading\nto potential memory corruption or use-after-free.\n\nTerminate the RX channel before returning on the TX prepare failure path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - In a reasonable network-facing deployment, an SPI Ethernet controller such as ENC28J60 receives an unauthenticated remote frame, raises its IRQ, and calls spi_sync(), which traverses the SPI core into the vulnerable fsl-lpspi DMA path.\nAC:L - An attacker can repeatedly drive DMA preparation and influence GFP_NOWAIT allocation pressure with packet flooding; once TX preparation fails after RX issuance, subsequent traffic deterministically exercises the stale RX descriptor without a race to win.\nPR:N - The SPI Ethernet receive IRQ path runs before protocol authentication and has no capability, device-node, or namespace privilege check, so a remote sender needs no privileges.\nUI:N - No victim action is needed after the network interface and SPI NIC are configured; attacker traffic alone invokes the affected transfer path.\nS:U - The stale DMA corrupts memory within the same host kernel security authority and does not inherently cross a VM, IOMMU, or other security scope boundary.\nC:H - The active RX DMA descriptor can write device- and packet-influenced data into unmapped, freed, and reallocated kernel memory, yielding memory corruption that can be leveraged for kernel-memory disclosure.\nI:H - The stale DEV_TO_MEM DMA operation provides attacker-influenced writes into freed or reallocated kernel memory, permitting object corruption and potentially control-flow hijacking or arbitrary kernel code execution.\nA:H - Continued DMA into invalid or repurposed memory can cause an IOMMU fault, kernel oops, panic, or hang, and unauthenticated traffic can trigger the condition repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:02.185Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ad370d1c7a9a832f77b2341513cd31188c9443af"
},
{
"url": "https://git.kernel.org/stable/c/cce2063404b2341e7b2bbf85eddfcd70a31a0033"
},
{
"url": "https://git.kernel.org/stable/c/af39a2698f69b584d14a00cffe0f51a2caa15337"
},
{
"url": "https://git.kernel.org/stable/c/e65505d91fa036a238968e4c10744244d1b968c4"
},
{
"url": "https://git.kernel.org/stable/c/d5c1060218a3749c8a18b36f8169d910fce20639"
},
{
"url": "https://git.kernel.org/stable/c/808033d80d5c9f8adf7e8de9317389270ce13430"
},
{
"url": "https://git.kernel.org/stable/c/9d000bdd250d649a11cd7f733175686877344582"
},
{
"url": "https://git.kernel.org/stable/c/01980b5da56e573d62798d0ff6c86bcaa2b22cbe"
}
],
"title": "spi: fsl-lpspi: terminate the RX channel on TX prepare failure path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64303",
"datePublished": "2026-07-25T08:49:38.223Z",
"dateReserved": "2026-07-19T15:36:31.779Z",
"dateUpdated": "2026-10-19T20:38:22.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53246 (GCVE-0-2026-53246)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-10-19 19:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
When a listening SCTP server processes a COOKIE_ECHO chunk, the cached
peer INIT chunk embedded after the cookie is parsed and its parameters
are later walked by sctp_process_init() using sctp_walk_params().
However, the chunk header length of this cached INIT chunk was not
validated against the remaining buffer in the COOKIE_ECHO payload. If
the length field is inflated, the parameter walk can run beyond the
actual received data, leading to out-of-bounds reads and potential
memory corruption during later parameter handling (e.g. STATE_COOKIE
processing and kmemdup() copies).
Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT
chunk length does not exceed the available data in the COOKIE_ECHO
buffer before it is used.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53246",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:27:37.139455Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:57:31.408Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cc272185c9a9a4b7febc2de52eeaa3d00f19091e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "edccbf3d63b0a3362bc916ea72edacc1e1ca456a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0861615c28de668669d748ef4eb913ea9262d13b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cached peer INIT chunk length in COOKIE_ECHO processing\n\nWhen a listening SCTP server processes a COOKIE_ECHO chunk, the cached\npeer INIT chunk embedded after the cookie is parsed and its parameters\nare later walked by sctp_process_init() using sctp_walk_params().\n\nHowever, the chunk header length of this cached INIT chunk was not\nvalidated against the remaining buffer in the COOKIE_ECHO payload. If\nthe length field is inflated, the parameter walk can run beyond the\nactual received data, leading to out-of-bounds reads and potential\nmemory corruption during later parameter handling (e.g. STATE_COOKIE\nprocessing and kmemdup() copies).\n\nAdd a bounds check in sctp_unpack_cookie() to ensure the cached INIT\nchunk length does not exceed the available data in the COOKIE_ECHO\nbuffer before it is used."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable COOKIE_ECHO processing is reached by remote SCTP packets delivered through the IPv4/IPv6 SCTP protocol handlers to a listening SCTP endpoint.\nAC:L - In a deployment with SCTP cookie HMAC disabled, the attacker can obtain a cookie through the normal INIT/INIT_ACK exchange, modify the cached INIT length, and send the forged COOKIE_ECHO without races or conditions outside attacker control.\nPR:N - The path is pre-authentication network protocol handling for a listening SCTP server; no local account or SCTP authentication is required when cookie HMAC is disabled.\nUI:N - Exploitation only requires sending SCTP handshake packets to the target listener and does not require victim user action.\nS:U - The impact is within the Linux kernel/network stack security authority and does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The inflated cached INIT length drives out-of-bounds parameter walking and attacker-sized kmemdup() reads beyond the received skb, which can expose kernel memory.\nI:H - The bug is kernel memory-safety corruption during nested parameter handling, and the higher-severity choice is appropriate because attacker-controlled parsing and copies beyond the valid buffer can corrupt kernel association state and plausibly support stronger primitives.\nA:H - The out-of-bounds reads and large attacker-controlled copies can trigger kernel faults, KASAN splats, allocation failure paths, or repeated remote crashes of SCTP processing."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:30.435Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cc272185c9a9a4b7febc2de52eeaa3d00f19091e"
},
{
"url": "https://git.kernel.org/stable/c/edccbf3d63b0a3362bc916ea72edacc1e1ca456a"
},
{
"url": "https://git.kernel.org/stable/c/0861615c28de668669d748ef4eb913ea9262d13b"
}
],
"title": "sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53246",
"datePublished": "2026-06-25T08:39:39.896Z",
"dateReserved": "2026-06-09T07:44:35.394Z",
"dateUpdated": "2026-10-19T19:57:31.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72083 (GCVE-0-2026-72083)
Vulnerability from cvelistv5
Published
2026-08-15 05:52
Modified
2026-10-19 21:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT
parameter list with transport_kmap_data_sg() and parses the destination
TransportID with target_parse_pr_out_transport_id(). For an iSCSI
TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns
the ISID in iport_ptr as a raw pointer into that mapped buffer.
The function then unmaps the buffer with transport_kunmap_data_sg() before
dereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and
core_scsi3_alloc_registration(). When the parameter list spans more than
one page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses
vmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual
address backing iport_ptr is torn down and every subsequent dereference is
a use-after-free read of the unmapped region.
Keep the parameter list mapped until iport_ptr is no longer needed: drop
the early transport_kunmap_data_sg() and unmap once on the success path,
right before returning. The error paths already unmap through the existing
"if (buf) transport_kunmap_data_sg(cmd)" at the out: label, which now runs
on every post-map error exit because buf is no longer cleared early. Only
reads of the mapping happen while spinlocks are held; the map and unmap
calls remain outside any lock. The sibling caller
core_scsi3_decode_spec_i_port() already uses the buffer before unmapping it
and is left unchanged.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4949314c7283ea4f9ade182ca599583b89f7edd6 Version: 4949314c7283ea4f9ade182ca599583b89f7edd6 Version: 4949314c7283ea4f9ade182ca599583b89f7edd6 Version: 4949314c7283ea4f9ade182ca599583b89f7edd6 Version: 4949314c7283ea4f9ade182ca599583b89f7edd6 Version: 4949314c7283ea4f9ade182ca599583b89f7edd6 Version: 4949314c7283ea4f9ade182ca599583b89f7edd6 Version: 4949314c7283ea4f9ade182ca599583b89f7edd6 Version: d2227f84ba0e97906153ac83db13213fb2e3938d Version: 3.2.9 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72083",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:51:39.405960Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:19:26.910Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_pr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7d56f5c868d92c9d504a34a3ea450bce481c7f63",
"status": "affected",
"version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
"versionType": "git"
},
{
"lessThan": "59a2a5a37dc49a641ad6bc64aee34e5a61025ffd",
"status": "affected",
"version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
"versionType": "git"
},
{
"lessThan": "9f8076cc73dfa6b10155978c160587e986b22169",
"status": "affected",
"version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
"versionType": "git"
},
{
"lessThan": "a040004846f1fbe687f6ec76d9ccc27b4ead42e4",
"status": "affected",
"version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
"versionType": "git"
},
{
"lessThan": "05b3e37433cf2eaf8867f1c16528aa347bb212ab",
"status": "affected",
"version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
"versionType": "git"
},
{
"lessThan": "cb7bdae7fba404852ade34b0c1445fbaf3e54fbb",
"status": "affected",
"version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
"versionType": "git"
},
{
"lessThan": "ef2ee18fec92088c7d8877baf7674e89389ccd66",
"status": "affected",
"version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
"versionType": "git"
},
{
"lessThan": "fda6a1f3c3d7047b5ce5654487649c2daa738bfc",
"status": "affected",
"version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
"versionType": "git"
},
{
"status": "affected",
"version": "d2227f84ba0e97906153ac83db13213fb2e3938d",
"versionType": "git"
},
{
"lessThan": "3.3",
"status": "affected",
"version": "3.2.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_pr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE\n\ncore_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT\nparameter list with transport_kmap_data_sg() and parses the destination\nTransportID with target_parse_pr_out_transport_id(). For an iSCSI\nTransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns\nthe ISID in iport_ptr as a raw pointer into that mapped buffer.\n\nThe function then unmaps the buffer with transport_kunmap_data_sg() before\ndereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and\ncore_scsi3_alloc_registration(). When the parameter list spans more than\none page (PARAMETER LIST LENGTH \u003e 4096), transport_kmap_data_sg() uses\nvmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual\naddress backing iport_ptr is torn down and every subsequent dereference is\na use-after-free read of the unmapped region.\n\nKeep the parameter list mapped until iport_ptr is no longer needed: drop\nthe early transport_kunmap_data_sg() and unmap once on the success path,\nright before returning. The error paths already unmap through the existing\n\"if (buf) transport_kunmap_data_sg(cmd)\" at the out: label, which now runs\non every post-map error exit because buf is no longer cleared early. Only\nreads of the mapping happen while spinlocks are held; the map and unmap\ncalls remain outside any lock. The sibling caller\ncore_scsi3_decode_spec_i_port() already uses the buffer before unmapping it\nand is left unchanged."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On LIO/iSCSI storage servers and appliances, a remote initiator sends PERSISTENT_RESERVE_OUT with REGISTER AND MOVE over TCP (port 3260); iscsit_process_scsi_cmd()\u2192target_execute_cmd()\u2192target_scsi3_emulate_pr_out()\u2192core_scsi3_emulate_pro_register_and_move() with no local access required.\nAC:L - The attacker fully controls the PR-OUT parameter list length (\u003e4096 to force vmap/vunmap), iSCSI TransportID format 01b with ISID, and can establish prerequisite PR registration and reservation via prior SCSI commands on the same session; no uncontrollable race or layout dependency exists.\nPR:N - Exploitation requires only the ability to act as a network SCSI/iSCSI client with LUN access to an exported target; no Linux UID, capability, or init-namespace root on the storage server is needed\u2014only standard iSCSI initiator connectivity (CHAP/ACL when configured).\nUI:N - Triggering is fully automated once an iSCSI session exists: the attacker issues scripted REGISTER, RESERVE, then REGISTER AND MOVE commands with a crafted \u003e4 KiB parameter list; no victim mount, click, or other interactive action is required.\nS:U - The UAF corrupts kernel heap state inside the target-core PR handler on the storage host; impact stays within that kernel security domain and does not inherently cross VM, container, or IOMMU boundaries (standard host compromise, not escape).\nC:H - After vunmap(), iport_ptr aliases freed kernel virtual address space and is dereferenced in strcmp(), __core_scsi3_locate_pr_reg(), and snprintf() into pr_reg_isid; per kernel CVSS guidance, UAF reads enable arbitrary kernel memory disclosure when uncertain.\nI:H - UAF reads of attacker-influenced unmapped PR-OUT data drive strcmp-based registration matching and snprintf copies into persistent kernel pr_reg structures; memory corruption/UAF is scored High for integrity because it can be leveraged for control-flow or state manipulation.\nA:H - Dereferencing iport_ptr after transport_kunmap_data_sg() vunmap() on multi-page buffers causes immediate invalid kernel virtual address accesses (oops/panic) on every qualifying REGISTER AND MOVE; UAF availability impact is High per kernel guidance even before full exploit development."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:40:05.325Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7d56f5c868d92c9d504a34a3ea450bce481c7f63"
},
{
"url": "https://git.kernel.org/stable/c/59a2a5a37dc49a641ad6bc64aee34e5a61025ffd"
},
{
"url": "https://git.kernel.org/stable/c/9f8076cc73dfa6b10155978c160587e986b22169"
},
{
"url": "https://git.kernel.org/stable/c/a040004846f1fbe687f6ec76d9ccc27b4ead42e4"
},
{
"url": "https://git.kernel.org/stable/c/05b3e37433cf2eaf8867f1c16528aa347bb212ab"
},
{
"url": "https://git.kernel.org/stable/c/cb7bdae7fba404852ade34b0c1445fbaf3e54fbb"
},
{
"url": "https://git.kernel.org/stable/c/ef2ee18fec92088c7d8877baf7674e89389ccd66"
},
{
"url": "https://git.kernel.org/stable/c/fda6a1f3c3d7047b5ce5654487649c2daa738bfc"
}
],
"title": "scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72083",
"datePublished": "2026-08-15T05:52:32.045Z",
"dateReserved": "2026-08-09T03:40:39.904Z",
"dateUpdated": "2026-10-19T21:19:26.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-21702 (GCVE-0-2025-21702)
Vulnerability from cvelistv5
Published
2025-02-18 14:37
Modified
2026-10-15 01:03
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
pfifo_tail_enqueue: Drop new packet when sch->limit == 0
Expected behaviour:
In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a
packet in scheduler's queue and decrease scheduler's qlen by one.
Then, pfifo_tail_enqueue() enqueue new packet and increase
scheduler's qlen by one. Finally, pfifo_tail_enqueue() return
`NET_XMIT_CN` status code.
Weird behaviour:
In case we set `sch->limit == 0` and trigger pfifo_tail_enqueue() on a
scheduler that has no packet, the 'drop a packet' step will do nothing.
This means the scheduler's qlen still has value equal 0.
Then, we continue to enqueue new packet and increase scheduler's qlen by
one. In summary, we can leverage pfifo_tail_enqueue() to increase qlen by
one and return `NET_XMIT_CN` status code.
The problem is:
Let's say we have two qdiscs: Qdisc_A and Qdisc_B.
- Qdisc_A's type must have '->graft()' function to create parent/child relationship.
Let's say Qdisc_A's type is `hfsc`. Enqueue packet to this qdisc will trigger `hfsc_enqueue`.
- Qdisc_B's type is pfifo_head_drop. Enqueue packet to this qdisc will trigger `pfifo_tail_enqueue`.
- Qdisc_B is configured to have `sch->limit == 0`.
- Qdisc_A is configured to route the enqueued's packet to Qdisc_B.
Enqueue packet through Qdisc_A will lead to:
- hfsc_enqueue(Qdisc_A) -> pfifo_tail_enqueue(Qdisc_B)
- Qdisc_B->q.qlen += 1
- pfifo_tail_enqueue() return `NET_XMIT_CN`
- hfsc_enqueue() check for `NET_XMIT_SUCCESS` and see `NET_XMIT_CN` => hfsc_enqueue() don't increase qlen of Qdisc_A.
The whole process lead to a situation where Qdisc_A->q.qlen == 0 and Qdisc_B->q.qlen == 1.
Replace 'hfsc' with other type (for example: 'drr') still lead to the same problem.
This violate the design where parent's qlen should equal to the sum of its childrens'qlen.
Bug impact: This issue can be used for user->kernel privilege escalation when it is reachable.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 57dbb2d83d100ea601c54fe129bfde0678db5dee Version: 57dbb2d83d100ea601c54fe129bfde0678db5dee Version: 57dbb2d83d100ea601c54fe129bfde0678db5dee Version: 57dbb2d83d100ea601c54fe129bfde0678db5dee Version: 57dbb2d83d100ea601c54fe129bfde0678db5dee Version: 57dbb2d83d100ea601c54fe129bfde0678db5dee Version: 57dbb2d83d100ea601c54fe129bfde0678db5dee Version: 57dbb2d83d100ea601c54fe129bfde0678db5dee |
||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-03T19:35:50.649Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:03:23.498Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/sch_fifo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "78285b53266d6d51fa4ff504a23df03852eba84e",
"status": "affected",
"version": "57dbb2d83d100ea601c54fe129bfde0678db5dee",
"versionType": "git"
},
{
"lessThan": "7a9723ec27aff5674f1fd4934608937f1d650980",
"status": "affected",
"version": "57dbb2d83d100ea601c54fe129bfde0678db5dee",
"versionType": "git"
},
{
"lessThan": "a56a6e8589a9b98d8171611fbcc1e45a15fd2455",
"status": "affected",
"version": "57dbb2d83d100ea601c54fe129bfde0678db5dee",
"versionType": "git"
},
{
"lessThan": "020ecb76812a0526f4130ab5aeb6dc7c773e7ab9",
"status": "affected",
"version": "57dbb2d83d100ea601c54fe129bfde0678db5dee",
"versionType": "git"
},
{
"lessThan": "79a955ea4a2e5ddf4a36328959de0de496419888",
"status": "affected",
"version": "57dbb2d83d100ea601c54fe129bfde0678db5dee",
"versionType": "git"
},
{
"lessThan": "e40cb34b7f247fe2e366fd192700d1b4f38196ca",
"status": "affected",
"version": "57dbb2d83d100ea601c54fe129bfde0678db5dee",
"versionType": "git"
},
{
"lessThan": "b6a079c3b6f95378f26e2aeda520cb3176f7067b",
"status": "affected",
"version": "57dbb2d83d100ea601c54fe129bfde0678db5dee",
"versionType": "git"
},
{
"lessThan": "647cef20e649c576dff271e018d5d15d998b629d",
"status": "affected",
"version": "57dbb2d83d100ea601c54fe129bfde0678db5dee",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/sch_fifo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.291",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.235",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.179",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.13.*",
"status": "unaffected",
"version": "6.13.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.14",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.291",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.235",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.179",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.130",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.83",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.14",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.3",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npfifo_tail_enqueue: Drop new packet when sch-\u003elimit == 0\n\nExpected behaviour:\nIn case we reach scheduler\u0027s limit, pfifo_tail_enqueue() will drop a\npacket in scheduler\u0027s queue and decrease scheduler\u0027s qlen by one.\nThen, pfifo_tail_enqueue() enqueue new packet and increase\nscheduler\u0027s qlen by one. Finally, pfifo_tail_enqueue() return\n`NET_XMIT_CN` status code.\n\nWeird behaviour:\nIn case we set `sch-\u003elimit == 0` and trigger pfifo_tail_enqueue() on a\nscheduler that has no packet, the \u0027drop a packet\u0027 step will do nothing.\nThis means the scheduler\u0027s qlen still has value equal 0.\nThen, we continue to enqueue new packet and increase scheduler\u0027s qlen by\none. In summary, we can leverage pfifo_tail_enqueue() to increase qlen by\none and return `NET_XMIT_CN` status code.\n\nThe problem is:\nLet\u0027s say we have two qdiscs: Qdisc_A and Qdisc_B.\n - Qdisc_A\u0027s type must have \u0027-\u003egraft()\u0027 function to create parent/child relationship.\n Let\u0027s say Qdisc_A\u0027s type is `hfsc`. Enqueue packet to this qdisc will trigger `hfsc_enqueue`.\n - Qdisc_B\u0027s type is pfifo_head_drop. Enqueue packet to this qdisc will trigger `pfifo_tail_enqueue`.\n - Qdisc_B is configured to have `sch-\u003elimit == 0`.\n - Qdisc_A is configured to route the enqueued\u0027s packet to Qdisc_B.\n\nEnqueue packet through Qdisc_A will lead to:\n - hfsc_enqueue(Qdisc_A) -\u003e pfifo_tail_enqueue(Qdisc_B)\n - Qdisc_B-\u003eq.qlen += 1\n - pfifo_tail_enqueue() return `NET_XMIT_CN`\n - hfsc_enqueue() check for `NET_XMIT_SUCCESS` and see `NET_XMIT_CN` =\u003e hfsc_enqueue() don\u0027t increase qlen of Qdisc_A.\n\nThe whole process lead to a situation where Qdisc_A-\u003eq.qlen == 0 and Qdisc_B-\u003eq.qlen == 1.\nReplace \u0027hfsc\u0027 with other type (for example: \u0027drr\u0027) still lead to the same problem.\nThis violate the design where parent\u0027s qlen should equal to the sum of its childrens\u0027qlen.\n\nBug impact: This issue can be used for user-\u003ekernel privilege escalation when it is reachable."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "Deterministic qlen underflow via pfifo_tail_enqueue with limit=0. Enables user-to-kernel privilege escalation through qlen accounting inconsistency in parent-child qdisc relationship."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:53:45.209Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/78285b53266d6d51fa4ff504a23df03852eba84e"
},
{
"url": "https://git.kernel.org/stable/c/7a9723ec27aff5674f1fd4934608937f1d650980"
},
{
"url": "https://git.kernel.org/stable/c/a56a6e8589a9b98d8171611fbcc1e45a15fd2455"
},
{
"url": "https://git.kernel.org/stable/c/020ecb76812a0526f4130ab5aeb6dc7c773e7ab9"
},
{
"url": "https://git.kernel.org/stable/c/79a955ea4a2e5ddf4a36328959de0de496419888"
},
{
"url": "https://git.kernel.org/stable/c/e40cb34b7f247fe2e366fd192700d1b4f38196ca"
},
{
"url": "https://git.kernel.org/stable/c/b6a079c3b6f95378f26e2aeda520cb3176f7067b"
},
{
"url": "https://git.kernel.org/stable/c/647cef20e649c576dff271e018d5d15d998b629d"
}
],
"title": "pfifo_tail_enqueue: Drop new packet when sch-\u003elimit == 0",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-21702",
"datePublished": "2025-02-18T14:37:43.429Z",
"dateReserved": "2024-12-29T08:45:45.748Z",
"dateUpdated": "2026-10-15T01:03:23.498Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…